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Mutually unbiased bases for quantum degrees of freedom are central to all theoretical 
investigations and practical exploitations of complementary properties. Much is known 
about mutually unbiased bases, but there are also a fair number of important questions 
that have not been answered in full as yet. In particular, one can find maximal sets of 
A' + 1 mutually unbiased bases in Hilbert spaces of prime-power dimension N = p", with 
p prime and M a positive integer, and there is a continuum of mutually unbiased bases for 
a continuous degree of freedom, such as motion along a line. But not a single example of a 
maximal set is known if the dimension is another composite number {N = 6, 10, 12, . . . ). 

In this review, we present a unified approach in which the basis states are labeled 
by numbers 0,l,2,...,Af — 1 that are both elements of a Galois field and ordinary in- 
tegers. This dual nature permits a compact systematic construction of maximal sets of 
mutually unbiased bases when they are known to exist but throws no light on the open 
existence problem in other cases. We show how to use the thus constructed mutually un- 
biased bases in quantum-informatics applications, including dense coding, teleportation, 
entanglement swapping, covariant cloning, and state tomography, all of which rely on 
an explicit set of maximally entangled states (generalizations of the familiar two-q-bit 
Bell states) that are related to the mutually unbiased bases. 

There is a link to the mathematics of finite affine planes. We also exploit the one-to- 
one correspondence between unbiased bases and the complex Hadamard matrices that 
turn the bases into each other. The ultimate hope, not yet fulfilled, is that open ques- 
tions about mutually unbiased bases can be related to open questions about Hadamard 
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matrices or affine planes, in particular the notorious existence problem for dimensions 
that are not a power of a prime. 

The Hadamard-matrix approach is instrumental in the very recent advance, surveyed 
here, of our understanding of the N = 6 situation. All evidence indicates that a maximal 
set of seven mutually unbiased bases does not exist — one can find no more than three 
pairwise unbiased bases — although there is currently no clear-cut demonstration of the 
case. 

Keywords: Mutually unbiased bases, complex Hadamard matrices, generalized Bell 
states 



Contents 

Acronyms 

Introduction 

1 Elements of quantum kinematics 

1.1 The Weyl-Schwinger legacy 

1.1.1 Complementary observables and mutually unbiased bases .... 

1.1.2 Existence of a basic pair of complementary observables 

1.1.3 Algebraic completeness of the basic pair of operators 

1.1.4 The Heisenberg-Weyl group; the Clifford group 

1.1.5 Composite degrees of freedom 

1.1.6 Prime degrees of freedom 

1.1.7 The continuous limit of iV — ^ oo 

1.1.8 Continuous degree of freedom 1: Motion along a line 

1.1.9 Continuous degree of freedom 2: Motion along a circle 

1.1.10 Continuous degree of freedom 3: Radial motion 

1.1.11 Continuous degree of freedom 4: Motion within a segment . . . 

1.2 A geometrically motivated measure of mutual unbiasedness 

2 Construction of mutually unbiased bases in prime power dimensions .... 

2.1 Galois fields 

2.2 The computational basis 

2.3 The dual basis 

2.4 Construction of the remaining A^-1 mutually unbiased bases 

2.4.1 Heisenberg-Weyl group 

2.4.2 Abelian subgroups 

2.4.3 The remaining — 1 bases 

2.5 Complementary period-A^ observables 

3 Generalized Bell states and their applications 

3.1 Generalized Bell states 

3.2 Quantum dense coding 

3.3 Quantum teleportation 

3.4 Quantum cryptography, covariant cloning machines, and error operators 

3.5 Entanglement swapping 

4 The Mean King's problem and quantum state tomography 



On mutually unbiased bases 3 



4.1 The Mean King's problem in prime power dimensions 

4.2 State tomography with discrete Weyl and Wigner phase-space functions 

4.2.1 Discrete Weyl-type unitary operator basis and phase-space func- 
tion 

4.2.2 The limit iV ^ oo of continuous degrees of freedom 

4.2.3 Discrete Wigner-type hermitian operator basis and phase-space 
function 

4.2.4 Covariance of the Wigner-type basis 

4.3 MutuaUy unbiased bases and finite affine planes 

5 MutuaUy unbiased Hadamard matrices 

5.1 Pairs of mutuaUy unbiased bases and Hadamard matrices 

5.2 Triplets of mutually unbiased bases and circulant matrices 

5.3 Classification of Hadamard matrices of size N < 5 

5.4 Affine families and tensor products 

5.5 Hadamard matrices of size A^ = 6 

5.6 Hadamard matrices for A'' > 7 

5.7 All mutually unbiased bases for A^ < 5 

5.8 Triplets of mutually unbiased bases in dimension 6 

5.9 A maximal set of mutually unbiased bases when N — 67 

5.10 Heisenberg-Weyl group approach for N ~ 6 

6 Brief summary and concluding remarks 

Acknowledgments 

Appendix A Generalized position and momentum operators for spherical co- 
ordinates |92 

Appendix B Standard sets of mutually unbiased Hadamard matrices for 

prime dimension 

Appendix C A prime-distinguishing function 

Appendix D Mutually unbiased bases for A^ = 4 

References 



100 



101 



Acronyms 

MU mutually unbiased 

MUB mutually unbiased bases 

MUHM mutually unbiased Hadamard matrices 

POVM positive operator valued measure 

SIC symmetric informationally complete 



Introduction 

Two orthonormal bases of a Hilbert space are said to be mutually unbiased (MU) 
if the transition probabilities from each state in one basis to all states of the other 
basis are the same irrespective of which pair of states is chosen. Put differently, 
if the physical system is prepared in a state of the first basis, then all outcomes 
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are equally probable when we conduct a measurement that probes for the states 
of the second basis. This situation is symmetrical, it does not matter from which 
of the two bases we choose the prepared state and which is the other basis that is 
measured: Unbiascdness of bases is a mutual property, possessed jointly by both 
bases. Familiar examples are the bases of position and momentum eigenstates for 
a particle moving along a line, and the spin states of a spin-^ particle for two 
perpendicular directions. 

When the Hilbert space dimension TV is a prime power, N = p", there exist 
sets of A'' + 1 mutually unbiased bases (MUB). These sets are maximal in the sense 
that it is not possible to find more than N + 1 MUB in any iV-dimcnsional Hilbert 
space, there is simply no room for the {N + 2)th basis. Such a maximal set of MUB 
is also complete because when we know all the probabilities of transition of a given 
quantum state towards the states of the bases of this set — exceptional situations 
aside, there arc (A^ + 1)(A^ — 1) = N"^ — 1 independent probabilities we can 
reconstruct the statistical operator that characterizes this quantum state; in other 
words we can perform full tomography or complete quantum state determination. 

The existence of a maximal set of MUB for N = is demonstrated by an 
explicit construction, not by an abstract existence proof. Various methods have 
been used for the construction of maximal sets of MUB, including the Galois- 
Fourier approach of this review. Other constructions are based on generalized Pauli 
matrices, discrete Wigncr fimctions, abelian subgroups, mutually orthogonal Latin 
squares, and finite-geometry methods. 

All known constructions rely on the fact that N is the power of a prime and, 
therefore, they say nothing about other dimensions, of which A'' = 6 is the smallest 
one and also the one that has been studied most intensely. At present, there is 
a widely shared conviction that one cannot have a maximal set of seven MUB 
for A'' = 6 and that the largest sets of MUB have no more than three bases. This 
conviction is strongly founded in a solid body of evidence but, strictly speaking, it 
is an unproven conjecture. 

This situation is reminiscent of seemingly similar existence questions about finite 
afBne planes, Graeco-Latin squares, and related geometrical structures where prime- 
power dimensions also play a privileged role. As suggestive as these similarities may 
be, there is, however, no known connection as yet between the two kinds of existence 
problems. 

There is a plethora of applications whenever maximal sets of MUB are available, 
in particular when the physical system is composed of many q-bits (A'^ = 2"), the 
building blocks of devices for quantum information processing. Not surprisingly, 
then, the rise of quantum information science has triggered fresh interest in MUB 
and, as a consequence, our knowledge about MUB and their applications is much 
richer now. But the various facts are scattered over a large number of publications, 
and the many pieces of the puzzle do not readily fit together and do not compose 
a uniform picture. 

We are here reviewing the state of affairs in an attempt to offer a unified view. 
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with emphasis on both the structural properties of MUB and their use in quantum- 
information apphcations. As in ah constructions of MUB in prime power dimension, 
a crucial element is a finite commutative division ring — a Galois field of N ele- 
ments Q Finite fields with N elements exist if and only if iV is a power of a prime, 
and the mathematical properties of Galois fields are exploited in all constructions 
of maximal sets of MUB. Modifications of these constructions in the absence of a 
finite field do not yield maximal sets of MUB for other dimensions. 

The paper is structured as follows. We begin with a brief survey of elements 
of quantum kinematics in Sec. [T] The legacy of Weyl and Schwinger: the notion of 
complementary observables and their algebraic completeness, the MUB associated 
with them, and the N ^ oo limit of continuous degrees of freedom — all these 
are central to the story told in Sec. 11.11 It is supplemented by remarks on the 
Heisenberg-Weyl group of unitary operators and the related Clifford group as well 
as, in Sec. 11.21 a geometrically motivated "measure of unbiasedness" of two bases, 
a distance in a real euclidean vector space. 

Section[2]deals with the construction of a maximal set of MUB in prime power di- 
mension, N = p'^\ systematically treated as a composite system of M p-dimensional 
subsystems. For the purpose of introducing some notational conventions, but also 
for the benefit of the typical working physicist for whom Galois fields are hardly the 
daily bread, we recall the most important and most relevant properties of Galois 
fields in Sec. 12.11 We are making extensive use of a formalism in which the num- 
bers 0, 1, 2, . . . , — 1 play a dual role — they are elements of a Galois field, but 
also ordinary integers. This somewhat unconventional approach enables us to give 
a compact, transparent construction of a maximal set of MUB in Sec. 12.2112.41 A 
fitting version of the discrete Heisenberg-Weyl group, also known as the general- 
ized Pauli group, is an important tool for the construction; its abelian subgroups 
define the MUB. In passing, we establish the contact between these MUB and the 
complementary observables of the Weyl-Schwinger methodology (Sec. 12. 5| ). 

The survey of applications of the maximal set of MUB in Sec. [3] begins with the 
construction of a complete set of maximally entangled states, the analogs of the 
familiar Bell states of two~q-bit systems, in Sec. 13.11 After brief accounts of their 
use for quantum dense coding (Sec. 13. 2|) and teleportation (Sec. 13. 3p . we discuss 
in Sec. 13.41 how the generalized Bell states facilitate quantum cryptography and 
eavesdropping with the aid of covariant cloning machines and comment on the role 
of the Heisenberg-Weyl operators in error correction. Section [3] closes with a brief 
discussion of entanglement swapping (Sec. 13. S"]) . 

The prime-power version of the so-called Mean King's problem (Sec. 14. ip opens 
the section on quantum state tomography. The Mean King's problem is, in fact, very 

ring is a set that is closed under two operations: addition and multiplication. They obey the 
usual rules, associativity and commutativity of both operations, the distributive law, existence of 
a unique neutral element for the addition and a neutral element 1 for the multiplication. A field, 
or division ring, is a ring with multiplicative inverses for every nonzero element. 
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closely related to the discrete analog of Wigner's continuous phase space function 
which — jointly with its Fourier partner, the analog of Weyl's characteristic function 
— is the subject matter of Sec. 14.21 We comment on the covariance of the Wigner- 
type operator basis and discuss the iV — > oo limit of continuous degrees of freedom. 
The relation to finite affine planes in Sec. 14.31 provides further insights into the 
underlying geometry. 

Section [5] is devoted to the matrices that transform pairs of MUB into each 
other: the complex Hadamard matrices. Pairs of bases may be equivalent or not, in 
the sense that one can map the basis states of one pair on those of the other pair 
by a unitary transformation in conjunction with permutations of the basis states 
(Sec. 15. The equivalence of triplets of MUB is more difficult to check (Sec. 15. 2p . 
Mutually unbiased Hadamard matrices (MUHM) are encountered when there are 
more than two MUB. Accordingly, one can investigate sets of MUB by studying 
the corresponding sets of MUHM, and vice versa. All Hadamard matrices of size 
iV < 5 have been classified (Sec. 15. 3|) . and all sets of MUB are known for < 6 
(Sec. 15. 7p . The situation is not so clear, and thus more interesting, for A = 6; we 
report what is known about the families of 6 x 6 Hadamard matrices in Sec. 15. 5[ 
after a general discussion of affine families and tensor products in Sec. 15.41 and we 
deal with MUB for A^ = 6 in Secs. l5.8tl5.10l Hadamard matrices for A^ > 6 get their 
share of attention in Sec. 15.61 

We close with a brief summary and concluding remarks (Sec. [5]) and provide 
some additional technical details in four appendixes. The standard set of MUHM 
for prime dimension is given in [Appendix B[ and a prime-distinguishing function 
related to this standard set is introduced in |Appendix C[ Finally, [Appendix D| deals 
with MUB for the two-q-bit case of N ^ A. 

1. Elements of quantum kinematics 
1.1. The WeylSchwinger legacy 

1.1.1. Complementary observables and mutually unbiased bases 

As emphasized by Bohr in his 1927 Como lecture,'^ quantum systems have properties 
that are complementary: equally real but mutually exclusive. If one such property is 
known accurately, then the complementary property is completely unknown. Here, 
"known accurately" means that the outcome of a measurement can be predicted 
with certainty, whereas "completely unknown" means that all outcomes are equally 
likely — the two properties are maximally incompatible. Familiar examples are the 
position and momentum of a particle moving along a line, and the x and z spin 
components of a spin-i object. These are, in fact, the extreme cases of a continuous 
degree of freedom and a binary degree of freedom — the latter being the "q-bit" of 
recent quantum information terminology. 

Intermediate are "q-nits," A^-dimensional quantum degrees of freedom (A^ > 1), 
for which the measurement of a physical property can have at most A^ exclusive 
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outcomes. Following WeyP'^and Schwing call a pair of observables, A and 

B, complementary if their eigenvalues are not degenerate (there is the full count 
of N different possible measurement results) and the sets of normalized kets \aj) 
and \bk) that describe states with predictable measurement outcomes for A and B, 
respectively, are MU, 

|(ajlMr = ^ foraUj, fc = 0,l,...,7V-l. (1.1) 

The important detail is not the value on the right, which is implied by the normal- 
ization to unit total probability, but that the transition probabilities on the left do 
not depend on the quantum numbers aj and 

Technically speaking, A and B are normal operatorfQ and \aj), \hk) are their 
eigenkets, which make up two bases that are orthonormal and complete, 

N-l N-1 
j=0 k=0 

where 1 is the identity operator. We recognize that the complementarity of A and 
B is in fact a property of their respective eigenket bases. The particular eigenvalues 
are irrelevant, we just need to know that they are not degenerate. It follows in 
particular that, if A and B are complementary, then a A and 13 B with a/3 ^ are 
complementary as well. And if a unitary transformation turns A into A' and B 
into B', then the pair A' , B' is complementary if the pair A^ B is. Therefore, we 
can shift the focus from the pair A, B of complementary observables to the pair 
{\a,)},{\bk)} of MUB. 

Whenever is it expedient to be specific about the observables associated with 
a basis, we will follow the guidance of Weyl and SchwingeiEl and choose unitary 
operators to represent physical quantities. In the present context, these will be 
nondegenerate cyclic operators with period N, 

^^ = 1, 5^ = 1, (1.3) 

with products of fewer than N factors not equaling the identity. The eigenvalues of 
A and B are then the TV different A^th roots of unity, 

A\a,) = , B\bk) = \bkh% with 7^ = e'^VA^ . (1.4) 

That these cyclic operators are a pair of complementary operators can be stated as 

ltr{^™S"} = Wn,o form,n = 0,l,...,A^-l, (1.5) 
which is the operator version of (jl.ip . Indeed, (jl.ip and (|1.5p imply each other. 

''In fact, there can be different rigfit-hand sides for infinite degrees of freedom, when normahzation 
is more subtle; see Sees. Il.f .8lfLf .If I We will mostly deal with finite degrees of freedom. 
"^A normal operator A commutes with its adjoint A^: AA^ = A^ A, and can be regarded either as 
a function of a more fundamental hermitian operator or as a function of a unitary operator. 
''A brief account of the history of the subject can be found in Ref. [T] 
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1.1.2. Existence of a basic pair of complementary observables 

The first question we address is whether there always is a pair of complenientary 
observables for each quantum degree of freedom. The affirmative answer begins 
with selecting an orthonormal reference basis |0), |1), . . . , — 1) — we will refer 
to it as the computational basis from Sec. 12.21 onwards. Then we define a second 
orthonormal basis \0),\1), . . . ,\N — 1) by means of the discrete quantum Fourier 
transformation, 

N-l 

l?) = 7lElfc)V> (1-6) 

'^-'^ fc=0 

so that 

0\k)^^jj^ for j,fc = 0,l,...,7V-l (1.7) 
V TV 

by construction — the two bases are MU, indeed. 

In analogy with the Pauli operators ax and CTz , we introduce the cyclic operators 
X and Z in accordance with 

X\3)^\jhi,, = l and Z\k)^\k)j'^, Z^ = l. (1.8) 

As an immediate consequence of (|1.7[) . we note that X and Z are unitary shift 
operators that permute the kets or bras of the respective other basis cyclically, 

X\k) = \k+l) for/c = 0, l,...,A^-2, X\N^l) = \0) (1.9) 

as well as 

forj =0,l,...,7V-2, (A^1|Z=(0|, (1.10) 

and (|1.5p holds for {A, B) = {X,Z), as it must. The fundamental Weyl commu- 
tation rule ZX — "fj^XZ follows. It is the analog of the familiar N = 2 identity 
o'zO'x — ^<^x<^z and is more generally, and more usefully, stated as 

X^Z" = 7/""Z"X'" , (1.11) 

valid for all integer values of m and n, both positive and negative. 

When we change the kets of the reference basis by phase factors, |A:) — |A:)e"'^'=, 
the resulting second basis will change accordingly and we get another complemen- 
tary partner X to the same observable Z. This freedom to adjust phases that do not 
affect the projectors of the reference basis but modify the projectors 

of the Fourier transformed basis is crucial for quantifying Einstein'^'i^ and de 
Broglie'^ wave-particle duality in the context of two-pattP^l^ and multi-patlP^ 
interferometers. 
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1.1.3. Algebraic completeness of the basic pair of operators 

The second question, which also has an afSrmative answer, is whether the pair X, Z 
of complementary observables parameterizes the degree of freedom completely. Put 
differently: Are all other operators functions of X and Zl 

As a first step, we observe that the projectors onto the respective eigenstates 
are polynomials of X or Z, 

n=0 

^z,,^,^\k){k\^-Y.{^N'zy\ (1.12) 

m=0 

where the Kronecker delta symbols are to be understood in the usual sense of an 
operator function, as exemplified by 

N-l 

/(Z)=^|fc)/(7^)(fc|. (1.13) 

fc=0 

The second step in writing an arbitrary operator _F as a function of X and Z is to 
exploit the completeness of the two bases, 

F^J2\j)0\m{k\^T.^xyJ^,kSzn% ^ith = (1.14) 

where the denominator is assuredly nonvanishinglfl This answers the second question 
by giving an explicit expression for as a polynomial of X and Z, here written 
in a unique way as an ATZ-ordered function: In products, all X operators stand 
to the left of all Z operators. Of course, quite analogously, we can also write F 
in a unique ZAT-ordered form — as an example recall the equivalence of the XZ- 
ordered operator on the left of (|l.lip with the ZA-ordered product on the right. In 
summary, there is not just one function of A and Z that equals the given operator 
F , there are many such functions. 

The lesson of these considerations is that the pair A, Z is algebraically complete, 
there are no operators that are not linear combinations of products of powers of 
A and Z. Accordingly, we can phrase Bohr's Principle of Complementarity, the 
fundamental principle of quantum kinematics, in the following technical terms: 
For each degree of freedom the dynamical variables are a pair of complementary 
observables;^ For a textbook discussion, see Ref. il7i 



''Numbers of the form of fj^ are known as "weak values" of F in the context of "weak measure- 
ments. '05] 
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1.1.4. The Heisenberg-Weyl group; the Clifford group 

Supplemented with powers of jj^, the X Z-ordered products that are implicit in 

YLrn,n=lNX"'Z^ with m, n = 0, 1, . . . , TV - 1 , (1.15) 

make up the Heisenberg-Weyl group of unitary operators, also called the generalized 
Pauli group, with operator multiplication as the composition, 

where we understand all subscripts as integers modulo N, and the same convention 
applies in 

l,m,n l,m,n ^ mri—l, — m, — n ' V-^'-*-'/ 

We could also use the ZX-ordered products to enumerate the group elements, or 
consider the set of all products of powers of X and Z without additional powers 
of as phase factors. Each recipe gives the same set of unitary operators, 
but double counting of group elements is most easily avoided when the ordered 
products are used. In the N ^ 2 example of X = ax and Z = a^, the eight group 
elements are ±1, ±ax, icz, and ±axO'z = Tify If we use the standard real 2x2 
Pauli matrices to represent (Tx and , then all eight unitary operators of the q-bit 
Heisenberg-Weyl group are represented by real matrices. 

In addition to this notion of the Heisenberg-Weyl group as a group of uni- 
tary operators that are composed by multiplication, there is also the notion of the 
Heisenberg-Weyl group as a group of unitary transformations 

F^YFY'' (1.18) 

that are composed by sequential execution. There is no difference in (jl.lSp between 
Y = and Y = 

X^'Z^'FiX, Z)Z-"X-" = F{-f'^X, Jn"'Z) = Z"X"F(X, Z)X-"'Z-'' . (1.19) 

More generally, the powers of 7^ in (|1.15p are irrelevant here, and therefore the 
group of unitary transformations has N'^ elements and is abelian. By contrast, the 
group of unitary operators is nonabelian; its abelian subgroups play a crucial role 
in Sec. 11.1.61 below. Weyl's view of "quantum kinematics as an abelian group of 
rotations" with its utter disregard of phase factors in the "ray fields" should be 
understood in this context; see Ch. IV, Sec. 14 in Ref. [3l 

We shall pay due attention to the phase factors in ()1.15|) where they are relevant, 
but otherwise remember that the physically more essential factors in (jl.lSp are the 
powers of X and Z , and thus we will not be overly pedantic when referring to the 
Heisenberg-Weyl group. In the given context, it will be clear whether we mean 
the group of unitary operators with its 7^ phase factors or the group of unitary 
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transformations. An example is the observation that the A^th power of Yi , 
differ from the identity operator, 



1 if is odd, 



" ^ if A^ is even. ^"^'^^^ 

For the group of unitary operators, the appearance of (—1)™" is crucial, telling 
us that one quarter of the ^ „ „s have period 2N for even A^, whereas this is of 
no concern for the group of unitary transformations. As an example, consider once 
more the N = 2 situation with X = (7^ and Z = cr^, for which 

{(T^az)'^ = -1 , {<Jx<JzTF{(Tx,az){(7x<yzT = F{cFx,a:,) . (1-21) 

The unitary operators C that map the Heisenberg-Weyl group onto itself un- 
der conjugation]^ that is: Y;,m,ra CYi^jn,nC^ equals one of the Yi^m,nS, constitute 
the so-called Clifford group^^^^ It contains the Heisenberg-Weyl group as a sub- 
group, but is truly larger. For N = 2, the Clifford group contains 24 unitary trans- 
formations (and is isomorphic to the symmetry group of the cube) whereas the 
Heisenberg-Weyl group contains only four unitary transformations. An example of 
a transformation belonging to the former but not the latter is the "q-bit Hadamard 
gate" {ax + (Tz)/\/2 that is represented by the familiar Hadamard matrix 

if we use the standard 2x2 matrices for and ct^ . 



1.1.5. Composite degrees of freedom 

If Af is a composite number, N — N1N2 with A^i > 1 and A^2 > 1, then some of the 
Heisenberg-Weyl operators have a shorter period, as exemplified by (lo,Afi,o)^'^ — 
(A^i)^2 = x'^ = 1. As a consequence, there are Heisenberg-Weyl operators that 
have different spectral properties and are not related to each other by a unitary 
transformation. 

It is then methodical to regard the A^-dimensional degree of freedom as com- 
posed of a A'^i -dimensional and a A^2-dimensional degree of freedom. Accordingly, 
the labels k of the kets | k) of the reference basis are understood as pairs fci , ^2 with 
k ^ ki + k2Ni whereby fci = 0, 1, . . . , A^i - 1 and A:2 = 0, 1, . . . , A^2 - 1- The action 
of the corresponding cyclic operators Xi and A2 is given by 

Xi\k) ^Xi\ki,k2) = |fci + l,fc2) = |fc + l) for fci =0,l,...,A^i -2, 
A2|fc) = A2|A:i,fc2) = |A:i,fc2 + l) = |fc-f Ai) for A:2 = 0, 1, . . . , iV2 - 2 , 

(1.23) 



'Anti-unitary operators could be, and often are, included — see Ref. 1181 for example — but we 
have no use for them here. 
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and the respective fci = iVi — 1 and k2 — N2 — 1 statements are 



Xi\k={k2 + l)m-l)=Xi\Ni~l,k2) = |0,fc2> = |fc2iVi), 

X2\k = ki+NiiN2-l)) = X2\ki,N2~l) = |A:i,0) - |fci) . 



(1.24) 



By construction, Xi and X2 have periods Ni and -/V2, respectively, and as a con- 
sequence of the algebraic completeness of the pair X, Z of complementary observ- 
ables, we can express Xi and X2 quite explicitly as functions of X and Z , with the 
outcome 



Clearly, Xi commutes with X2 because commutes with X^'^ when N1N2 ~ N, 
as is the case here. 

Likewise one constructs the complementary partners Zi and Z2 as the operators 
that cyclically advance the respective quantum numbers of the common eigenbras 



In summary, then, the original TV-dimensional degree of freedom, parameterized 
by the pair X, Z, is decomposed into the product of two degrees of freedom, a 
A''i-dimensional and a iV2-dimensional one, parameterized by the pairs Xi, Zi and 
^2,^2, respectively. 

In passing, we note that the two bases of product kets |fci,fc2) and |ji,j2) are 
MU. This illustrates how one can construct MUB of a composite degree of freedom 
from such bases of its constituents. 

If A^i or A'2 are composite numbers themselves, this reasoning can be applied 
again, if necessary repeatedly, until one has one degree of freedom for each prime 
factor of N. These prime degrees of freedom are fundamental and cannot be decom- 
posed further. As emphasized by Schwinger in his teaching,'^ they are the elementary 
quantum degrees of freedom. 

1.1.6. Prime degrees of freedom 

The simplest prime degree of freedom is the q-bit case N = 2, for which we have 
X — (Tx, Z = (72, and XZ = —Wy With |0) and |1) denoting the eigenkets of CTz 
to eigenvalues -1-1 and —1, respectively, the eigenkets of are 2~2(|0) ± |1)), and 
the eigenkets of ay are 2~2 (|0)i ± |1)). These three bases are pairwise MU, and the 
three operators X, Z , and XZ are pairwise complementary. 

More generally, we can consider any two components A = a ■ a and B ^ b ■ a oi 
Pauli's vector operator a whose cartesian components are fj,, and CTz. Opera- 
tors A and B are complementary if the nonvanishing three-dimensional numerical 
vectors a and b are orthogonal to each other, a ■ b — 0. Since there are at most 
three pairwise orthogonal vectors, there are at most three pairwise complementary 





(1.25) 
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operators and at most three MUB. The choice Ux, (Jy, for the three operators is, 
therefore, not particular, but typical. 

If N is an odd prime, = 3, 5, 7, 11, 13, ... , then all unitary Heisenberg-Weyl 
operators i^; „ „ of (|1.15p are cyclic with period N , except for the identity 1 = Fq q q. 
Further, we observe that the + 1 operators 

X, XZ, ... , XZ^-^ , Z (1.27) 

are pairwise complementary,^! as one verifies most directly with the aid of (jl.Sp and 
()1.16|) in conjunction with 

It follows that the + 1 bases of eigenkets, one for each of the operators in (|1.27p . 
are MU. In addition to the eigenbases of X and Z that we met in Sec. 11.1.21 there 
are thus — 1 more such bases. 

And there cannot be a (A^ + 2)th basis because a counting argument shows 
that one can at most have A^ + 1 bases that are MU.'^S] One way of seeing this is 
presented in Sec. 11.21 below. 

In this context, we note here that the powers of the operators in (|1.27p make 
up A^ + 1 abelian cyclic subgroups of the Heisenberg-Weyl group with A^ unitary 
operators in each subgroup. Remembering that the identity is contained in each 
subgroup, this gives a total count of (A^ + 1)(A^ — 1) + 1 = A^^ operators, one rep- 
resentative for each set of „s with common m, n values, that is: one count for 
each X™Z" product. 

Explicitly, ket the fcth eigenket of the ith basis, XZ*|i,fc) = |i,fc)7^, is 

given by 

AT odd: |z,fc)^ ^|;)T,-'='7;^('-i)/2 forz = 0,l,2,...,A^~l (1.29) 

in terms of the reference basis of eigenkets of Z. For i = we have the eigenstates 
of X, |fc) = |0, fc). While correctly states the eigenkets of XZ* for aU odd A^, 

these bases are pairwise MU only if N is prime. With due attention to the extra 
phase factors required by (11.201) one can give a similar expression for |i, fc) when A^ 
is even. 

In summary, we can systematically construct A^ + 1 bases that are MU if A^ is 
prime. As noted, the construction based on the cyclic operators in (|1.27p does not 
work if N is composite; try A^ = 4 to see what goes wrong. We return to the case 
of A^ = 6 in Sec. 15.101 and a general discussion for arbitrary A^ > 2 is given in 
[Appendix C| 

Yet, this is not the end of the story. If Af = p^' is the power of a prime, for which 
A^ = 8 = 2^ and A^ = 9 = 3^ are examples, it is possible to modify the construction 
such that it does work in a closely analogous way. The clue is to replace the modulo- 
A^ shifts of (|1.9p and ()1.10p by shifts of a Galois field arithmetic that treats the 
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TV-dimensional degree of freedom systematically as composed of M p-dimensional 
constituents. This is the theme of Sec.[2l followed by applications in Sees. [3] and ID 
This Galois cure is, however, not available for iV = 6 and = 10 or other com- 
posite N values that are not powers of a prime, simply because the number of 
elements in a finite field is always a prime power. Section [5] contains a report on 
what is known about these cases, in particular about = 6. The question whether 
there are seven MUB for iV = 6 is currently unanswered, but there is a lot of ev- 
idence, and a growing conviction in the community, that there are no more than 
three such bases. And three such bases are immediately available by pairing each of 
the three q-bit bases (iVi = 2) with one of the four q-trit bases — 3) to product 
bases as in (jl.26|) . 

1.1.7. The continuous limit of N ^ 00 

Since composite values of N refer to composite quantum degrees of freedom, we 
take the limit N ^ 00 through prime values of N, thereby dealing with a single 
degree of freedom of increasing complexity. The prime nature of N will not be so 
crucial, however, but we make use of the fact that large primes are odd numbers and 
relabel the kets of the reference basis |fc) and the bras (j| of the Fourier-transformed 
basis such that now j, fc = 0, ±1, ±2, . . . , ±^(Af — !)■ 

Next, we introduce a small, eventually infinitesimal, parameter e by 

(1.30) 

to account for the fact that the basic unit of complex phase 2Tr/N gets arbitrarily 
small when N — >■ 00. Aiming at a continuous degree of freedom in this limit, we 
also relabel the states in accordance with 

j^je^a^ 0, ±e, ±2e, . . . , ± - | ) , 

k — > ke = 6 = 0,±e,±2e,...,±(^- - |) . (1.31) 

The numbers a and b will cover the real axis, —00 < a,b < 00, when — > 00, e — > 0. 

The unitary operator X acting on \k) increases k by unity, so that it effects 
b ^ b + e. Likewise Z applied to (j| results in a — > a -f- e. This suggests the identi- 
fication of hermitian operators A and B such that 

X = e^^^ with A^A\ 

Z = c'^^ with B = . (1.32) 
The Weyl commutation relation ()1.11|) then appears as 



or 



g— iafegia_Bgifej4 



(1.34) 



On mutually unbiased bases 15 



The two equivalent versions 



gib(A - al) ^ g-iaBgifeAgiaS 



-laB ji^^mB 



ia(B-bl) JbAJaB-ibA Jae^^'^Be 

^ ' P P P P 



-ibA 



seem to imply that 



= e 



A - al, 



(1.35) 



(1.36) 



but this does not follow without imposing a restricting condition, just as e^" — e^^ 
does not imply a = /?, but only that a — /3 is an integer multiple of 27r. 

The said restriction is that, for large N, only a, b values from a finite vicinity 
of matter, which is to say that we break the cyclic nature of the labels a, b, 



a e 



ia'B 



a' (mod 27r/e) 



Ab'A 



\b) ^\b + b' (mod27r/e)) 



(1.37) 



and take for granted that all relevant values of a, a' and 6, b' are such that we 
stay inside the range — (tt/e — e/2) • • • (tt/c — e/2). Put differently, we give up the 
periodicity that would force us to identify a = +oo with a = — oo in the e — > limit. 

After performing the iV — )■ oo, e — > limit with this restriction, the statements 
of (|1.36p hold with continuous values for a and b. We can, therefore, exhibit the 
terms that are linear in a or 6 and arrive at 



AB-BA= [A, B]=il. 



(1.38) 



We recognize, of course, Heisenberg's commutation relation for a pair of comple- 
mentary hermitian observables of a continuous degree of freedom, such as position 
A and momentum B (in natural units) for the motion along a line. 

These N oo considerations for X and Z have to be supplemented by coun- 
terparts for their respective kets and bras. We need to identify 



1 



\" — —]= 
and then get 



(Jl 



with je = a, and \b) — \k) 



1 



with fee 



{a\b) 



Aab 



as the analog of (11.71) as well as 

(a|a') = S{a — a') 

and 



{b\b') ^5{b^b') 



(1.39) 



(1.40) 



(1.41) 



da\a){a\ = 1 = / db\b){b\ 



(1.42) 



as the continuum versions of the orthogonality and completeness relations in (|1.2p . 
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This discussion of the N ^ oo hmit is a variant of Schwinger's treatment in 
Sec. 1.16 of Ref. [6] see also Sec. 1.2.5 in Ref. [T71 It should be appreciated that 
iV — > oo is not a limit in the precise sense that one has in calculus. Rather, it is a 
systematic method for inferring the properties of the basic operators for continuous 
degrees of freedom, but these operators then stand on their own and the consistency 
of the inferred algebraic properties must be verified. 

We note that, in addition to the standard symmetric limit that treats X and 
Z on equal footing and results in the Heisenberg pair of A and B (position and 
momentum for motion along a line), there are also asymmetric limits. For instance, 
if the position variable — the analog of the hermitian A of (|1.32|) — is kept periodic 
over a finite range in the limit, one obtains the pair of azimuth-angle operator 
and angular-momentum operator for motion on a circle,'^^! with which we deal in 
Sec. 11.1.91 In a third way of taking the N ^ oo limit, the hermitian position variable 
is kept positive throughout and one arrives at a continuous quantum degree of 
freedom of the kind that parameterizes radial motion; see Sec. II. 1.101 Finally, there 
is a fourth procedure, in which the position values cover a finite range without, 
however, retaining the cyclic nature by identifying the boundaries with each other; 
this results in a degree of freedom of the kind associated with the polar angle in 
spherical coordinates (Sec. Il.l.ll|) . 

1.1.8. Continuous degree of freedom 1: Motion along a line 

Knowing that there are TV -I- 1 pairwise complementary observables for prime de- 
grees of freedom, we expect to find an infinite number of them for a continuous 
degree of freedom. Indeed, there is a continuum of pairwise complementary observ- 
ables and, therefore, a continuum of MUB, although an interesting complication 
can be observed too^ 

Harking back to Sec. 11.1.61 we recall that each basis in the set of MUB consists of 
the joint eigenstates of the unitary operators that one gets by taking products of one 
of the unitary operators in the list ()1.27p with itself. Translated into the continuum 
case of Sec. I1.1.7| the corresponding unitary operators are those of (|1.34p , and since 



tells us that two of these unitary operators commute if 0162 = ^102, the opera- 
tors e^^^e^"^ for which (a, h) = {at, fit) with common values of a and fi make up 
an abelian subgroup of Heisenberg-Weyl operators. The elements of the subgroup 
specified by the pair (a, /3) are labeled by parameter t, which takes on all real val- 
ues. For a = /3 = 0, we have the one-element subgroup of the identity; this case is 
of no further interest and excluded from the following considerations. 
It is expedient to choose the single-exponent form 



gibiAgiaiB gi62Agia2B _ gi(aib2 - 6ia2) gife2Agia2S gibi^giaiB 



(1.43) 



y(a,/3;t) 



(1.44) 
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for the subgroup elements, so that the subgroup composition rule 



Y{a, (3; h)Y{a, (3; ts) = Y{a, (3; h + 1^) 



(1.45) 



involves no additional phase factors, and we denote the common eigenkets and 
eigenbras of all unitary operators in the (a,/3) subgroup by \a,l5;y) and (a,/3;7/|, 



y(a, /3; t)\a, p; y) = \a, p; y)e''y , {a, p; y\Y{a, /3; t) = e''y{a, p; y\ . (1.46) 



If one wishes, one can regard \a,f3;y) and {a,l3;y\ as eigenstates of the hermitian 
operator (3 A + aB with eigenvalue y, but we prefer to work with the sets of bounded 
unitary operators rather than the unbounded hermitian operators. 
As usual, the eigenstates are normalized to the Dirac delta function, 



for A 7^ 0, consistent with Y{\a, A/3; t/\) = Y{a, (3; t). The subgroup for (Aa, A/3) is 
identical with the subgroup for (a,/3), with the elements parameterized differently. 
The respective eigenstates are in one-to-one correspondence, but differ from each 
other by a normalization factor (except when A = — 1)- 

These statements have no analogs for finite N, when the normalization of states 
is unambiguous and the parameterization of the abelian subgroups is essentially 
unique. In the continuous case, by contrast, there is more than one way of parame- 
terizing the continuous abelian subgroups, and one would have to impose constraints 
on a and /3 to avoid this innocuous ambiguity, such as insisting on a = cos9 and 
P = sm6 with < ^ < tt or, equivalently, permitting only {a, (3) = (0, 1) and a = 1 
with arbitrary (3. Clearly, constraints of this sort are a bit awkward, and they are 
not necessary. 

The projector \a, j5]y){a, j5;y\ is given by 



(a,/3;2/|a,/3;y') = 5{y - y') 



(1.47) 



which implies that, up to a phase factor of no consequence. 




(1.48) 



OO 




(1.49) 



— oo 



as one verifies by, for instance, checking that 



(|a,/3;y)(a,/3;y|)|a,/3;t/') 



W,P;y) S{y-y') 



(1.50) 



The completeness relation 



oo 




(1.51) 



— oo 



follows and confirms that we have a basis for each of the abelian subgroups. 
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Next, we consider two different abelian subgroups, specified by (a,/3) and 
(a'j3'), respectively, with a/3' ^ /3a', and evaluate the transition probability den- 
sitjo between their respective eigenstates by means of 



which is Eq. (11) in Ref. [24l Since the value of | (a, /3; y\a' , /3'; y') | does not depend 
on the quantum numbers y and y' that label the states of the two bases, the two 
bases are MU. This is true for the bases to any two different abelian subgroups. 
Indeed, we have a continuum of MUB for a continuous degree of freedom. 

As a consequence, the hermitian operators /3A + aB and /3'A + a' B are com- 
plementary observables if their commutator \[PA + aB, f3' A + a' B] = (a/3' — /3a')l 
does not vanish. The absolute value of this commutator appears in the denominator 
of ()1.52|) . Not unexpectedly, for a continuous degree of freedom, there is a continuum 
of pairwise complementary observables. 

We could have arrived at the same conclusion by the following more di- 
rect argument that exploits the observations made after (|1.2p . There are uni- 
tary transformations that turn pA + aB into nA and f3' A + a' B into n' B with 
nn' — ajS' — /3a' ^ 0. Now, since the pair A, B is complementary, so is the pair 
kA,k'B, which implies that the pair (3A + aB, P' A + a' B is complementary as 
well, and their bases of eigenstates are MU. 

Whereas the right-hand side of (|l.ip has the same value of A^~^ for any pair 
of MUB for a A^-dimensional degree of freedom, this is not the case for the right- 
hand side of (|1.52p : recall footnote |bl. For a given pair of bases specified by the 
coefficients (a,/3) and (a',/3'), we can either choose (a",/3") = (a + a',/3 + /3') or 
(a",/3") = (a — a', /3 — /3') to supplement them with a third basis such that these 
three MUB have the same numerical value for the constant transition probability 
densities between each pair of bases. The basis for any fourth choice (a'", /3"') will 
have a different value for one or more of its transition probability densities with 
the earlier three bases. This observation by Weigert and Wilkinsor!^ means that 
the continuous set of MUB, composed of the bases of (|1.46p . contains three-element 
subsets that are polytopes of MUB in the sense of Sec. 11.21 



(a, /3; y|a', /S'; y') |^ = tr{ (|a, /3; y){a, P; y\) (|a', /3'; y') (a', P'; y'\) } 

= / ^tr{Y{a,P;t)Y{a',P';t')}e--^('y + ^'y') 




1 



(1.52) 



27r|a^' - Pa'\ ' 



^It is a density because we need to multiply with dydy' to get the probabilities referring to 
infinitesimal intervals of y and y' . 
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1.1.9. Continuous degree of freedom 2: Motion along a circle 

We parameterize the position around the circle by the 27r-periodic azimuth tp — 
with \lp) = |<y9 + 27r), for instance — and normahze the corresponding bras and kets 
in accordance with the orthogonality and completeness relations 

{ipW) = 2ir5'^^-\^-^'), J = (1.53) 

(27r) 

where the integration range is any 27r interval and S'--^'^\ ) denotes the 27r-periodic 
version of Dirac's delta function, 

S(^-H^-^') = ± ^ e'K^-^'K (1.54) 

We regard the azimuthal states \ip) as eigenstates of a unitary operator E, 

E\^)^\v)e'^, E = I ^\^)e'^{p\. (1.55) 

(2vr) 

This E is the proper — > oo limit of X in the present context. 

All azimuthal wave functions ■(/'(v) — {v\ ) — + ^tt) are periodic, and the 
Fourier series of {(p\ identifies the eigenstates of the associated angular momentum 
operator L, 

oo 

(^1= J2 L\l)^\l)l. (1.56) 

^ — — OO 

Their orthonormality and completeness relations are 

oo 
/— — oo 

consistent with (|1.53p . 
In view of 

(^10 =e"^, |(¥>|Or = l, (1.58) 

the (/3-basis and the /-basis are MU. The respective unitary shift operators are 
powers of E and exponential functions of L, 

£""11) ^\l + m) , {ip\e''f>^ = {if + (t>\ . (1.59) 

Their products £''"e'"^ make up the Heisenberg-Weyl group with the basic Weyl 
commutation relation given by 

which is the analog of ()1.34p . For each modulo-27r value of (f), there is an abelian 
subgroup composed of the unitary operators {Ee'-'^^)™ with m = 0, ±1, ±2, .... 
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Despite these analogies and the great structural similarities with the situation 
of Sec. 11.1.81 there is a striking difference: There is no third basis that is MU with 
respect to both the (/j-basis and the Z-basis. 

To make this point, let us assume that ket | ) belongs to such a third basis. 
Then it must be true that 

|(^|)|^ = A>0 for all and |(?|)P = /i>0 for aU L (1.61) 



The completeness relations in (|1.53|) and ()1.57p then imply 

dip 
2^ 



2 / d^^ 



(27r) (27r) 

OO oo 

and (I)- E W\)\'= E t' = ^' (1-62) 

^ — — oo /— — oo 

which contradict each other. It follows that there is not even a single ket with the 
properties (ll.61|) : indeed, there is no third basis. 

This situation of a missing third basis is a unique feature of the E, L-type 
continuous degree of freedom. There is always a third basis for finite A'' — the 
three eigenbases to X, Z, and XZ of (I1.27P are pairwise MU for all TV > 1 — and 
there is a continuum of MUB for the continuous degrees of freedom of the three 
other types. It appears that the combination of the continuous position variable E 
with the discrete momentum variable L is at the heart of the matter. For the other 
continuous degrees of freedom, the respective position and momentum variables are 
both continuous, as will be discussed below. 

The nonexistence of a third basis that supplements the (p-basis and the Z-basis 
does not exclude the possibility that there are other bases that are MU, perhaps 
with sets of MUB that have more than two elements. Currently, we are not aware 
of any such set, however, but its bases would have to be rather unusual. For, two 
different discrete bases (such as the Z-basis) cannot be MU, nor can two different 
continuous bases (such as the yj-basis) be MU. And if one basis is discrete and the 
other continuous, the dilemma of (jl.62l) cannot be avoided. 

1.1.10. Continuous degree of freedom 3: Radial motion 

In spherical coordinates, radial motion is characterized by a positive position oper- 
ator i? > 0, 

oo 

f dr 

R\r) = \r)r with r > , {r\r') = r5{r - r') , —\r){r\=l, (1.63) 



whereas the eigenvalues of its complementary partner S are all real numbers, 

oo 

S-js) = |s)s with -oo < s < cx) , {s\s') ^ 5{s-s') , J ds\s){s\ ^ 1 . (IM) 
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{r\s) = -= (1.65) 



The transition amplitudes 



confirm that the r-basis and the s-basis are MU and that R and S are a pair of 
complementary observables. 

The unitary shift operators i?'* and e^'*^'^ have the expected effect when applied 
to the states of the other basis, 

(r|e'^^ = (e^r| , i?"|s) = \s + t) , (1.66) 

as follows from (|1.65p . The resulting Weyl commutation relation 

and the Heisenberg commutator 

[R,S] = ii? (1.68) 

tell us that S is the hermitian generator of scaling transformations, 

e"^^^i?e'^^ = e-^i?, (1.69) 

fitting to the positive nature of R. 

The unitary operator products in (|1.67p make up the Heisenberg-Weyl group 
here, and the abelian subgroups can be characterized by common values of r and 
/J, in (i. A) — k{t, /i). In full analogy with (|1.46l) - (|1.52l) . then, the bases defined by 

for (r, ^) 7^ (0,0) are pairwise MU, 

\{r,^,;a\T',^,'■,a')\' jr. (1.71) 

Just as in Sec. 11.1.81 here too we have a continuum of pairwise complementary 
observables and a continuum of MUB, and the set of MUB has three-element poly- 
topes in the sense of Ref. i24| The R, 5'-type degree of freedom is really quite similar 
to the A, B-type degree of freedom of the Heisenberg kind, because log R and S 
are a Heisenberg pair of operators: [logi?, S] — il. This commutator is a particular 
case of 

[f{R),S]=iR^, (1.72) 
which follows from (|1.68|) or from (ll.69p . 
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I. 1.11. Continuous degree of freedom 4- Motion within a segment 

After dealing with the azimuthal and radial degrees of freedom in Sees. [TTL^ and 

II. l.lOl we now turn to the degree of freedom associated with the polar angle •& 
of spherical coordinates, {x,y,z) = (r sini? cos r sini^ siniy9, r cos i?). Since the 
values of i) are restricted to a finite interval < < tt, where the endpoints are 
not identified with each other as is the case for the periodic azimuth (p, we speak 
of "motion within a segment," very much like the popular textbook example of 
the "particle in a box," about which some non-textbook material is reported in 
Ref. 1251 The relations between the position and momentum operators for cartesian 
and spherical coordinates are discussed in [Appendix A[ 

The eigenstates of the position variable Q and its complementary partner Q are 
related to each other by 

tan — 1 with < iS < n and — cx) < < oo , (l-^S) 



and the respective orthonormality and completeness relations are 

7r 

=sini?(5(i5-?9'), f^W){^\ = ^ (1-74) 
J smv 



for the z9-basis as well as 

oo 

(wlw') = S{uj -uj'), J dcj Icj) (w| = 1 (1.75) 

— oo 

for the w-basis. Accordingly, the unitary shift operators are specified by 

(i?|ei^^ = ^ ftan f |cj) = |cj + w') , (1-76) 

^ ' ^ ' i?' = 2arctan(e^tanf) V 2/ ' ' ' ^ ' 

telling us that the unitary transformation effected by e''^^ has no simple geometrical 
meaning. 

The Weyl commutation relation reads 

(tan|)V^ = e-'-V^^(tan|)'^ (1.77) 
from which we get the Heisenberg commutator 

[6,17] = isine. (1.78) 
More generally, we have the analog of (|1.72l) . 

[/(e),J7] ^isine^^, (1.79) 



and the particular case 

r Pi 1 

il (1.80) 



log tan — . Vl 

^ 2 ' 
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identifies log tan ^ and SI as a Heisenberg pair of complementary observables. Re- 
membering the lessons of Sees. II. iT^ and [T.1.10[ we conclude that the abelian sub- 
groups of the Heisenberg- Weyl group composed of the unitary operators of (|1.77p 
define a continuum of MUB, with the set of MUB having three-element subsets 
that are MUB polytopes in the sense of Ref. [24l 

We close this excursion into the realm of continuous degrees of freedom with a 
comment on the completeness and orthonormality relations (|1.63p and (|1.74p . Why 
did we not absorb the factors r and sin i9 into the normalization of the respective 
bras and kets? There are two good reasons: (i) Such a change of normalization 
would spoil the relations (|1.65p and (|1.73l) : (ii) these factors would re-appear in a 
disturbing way when the orthonormality and completeness relations are rewritten 
in terms of the eigenstates for the Heisenberg partners log R and log tan § of 5' and 
f2, respectively. In other words, it is very natural to have the factors r and sini? in 

(frea]) and (fr74i) . 

In view of the various subtle issues regarding the normalization of eigenkets and 
eigenbras for continuous degrees of freedom, the definition of what constitutes a 
pair of complementary observables — given above in the context of (jl.ip — should 
perhaps be modified to state more carefully that two nondegenerate observables 
A and B are complementary if one can normalize their respective eigenstates con- 

I 1 2 

sistently such that |(a|6)| has the same value for all eigenbras (a| of A and all 
eigenkets |6) of i?. 

1.2. A geometrically motivated measure of mutual unbiasedness 

The kets | ) in A^-dimensional Hilbert space, and their adjoint bras ( | = | )^ are 
rather abstract geometrical objects, and so are the linear operators that map kets 
on kets and bras on bras, among them the statistical operator p that summarizes 
our knowledge about the state of the physical iV-dimensional degree of freedom 
under consideration. With reference to a specified basis, the kets are represented 
by numerical column vectors {N x 1 matrices), the bras by row vectors "0^ (1 x 
matrices), and the linear operators by x matrices, among them the density 
matrix g for the statistical operator p. We denote these relationships hy tp = \ ), 
ip'' = { I, and g = p, respectively. 

There are many density matrices, one for each reference basis, to one and the 
same statistical operator, much like there are many trios of components for the 
velocity vector of the moon, one trio for each coordinate system. One should not 
confuse the velocity vector with its components, or the statistical operator with the 
density matrix used to represent it numerically. 

When they exist, maximal sets of MUB form a very distinct geometrical pattern 
in the set of hermitian matrices of unit trace — the real euclidean space that 
contains the set of density matrices. This is where we begin our story about maximal 
sets of MUB, although in most of what follows we will prefer to work directly in 
Hilbert space. The two pictures ought to be considered as complementary, each of 
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them possessing advantages and drawbacks. 

The set {g} of density matrices is a convex body in the set of hermitian matrices 
of unit trace. Its pure states are the one-dimensional projectors. The set of its pure 
states has real dimension 2(iV— 1), and can be identified with the complex projective 
Hilbert space. The dimension of {g} is N'^ — 1, and the space in which it sits can 
be regarded as a vector space, with its origin at the maximally mixed state 

^^. = ^1 = ^1 = P., (1.81) 

where 1 is the identity operator of (|1.2p and 1 is the unit matrix that represents it. 
With any hermitian matrix M of unit trace we associate a traceless matrix 

m = M-(?^. (1.82) 

The set of these traceless matrices forms a vector space, and we will think of them 
as vectors. The matrix representation is used to define the inner product 

mi • m2 = itr{(Afi - g,){M2 ~ g.)} . (1.83) 

Thus the squared distance between the tips of the two vectors mi and ni2 is 

Z)(mi,m2)2 = itr{(Afi - Ah)^} . (1.84) 

With any unit ket |e) in Hilbert space we associate a vector e in R^'^^, the space 
of (iV^ — l)-component real vectors, through 

e = 7^,V^-^'. -|e)(e|-p. (1.85) 

so that the squared length of e is 



|2_ ^-1 

' 2N 



(1.86) 



All vectors in R^ "-^ with this specific length sit on the surface of the outsphere 
of the body {g}, the smallest sphere containing the body. But it is important to 
realize that it is only a small 2(iV — 1) -dimensional subset of this outsphere that 
corresponds to vectors in Hilbert space — most of the outsphere lies outside the 
body. The case TV = 2 is an exception: In this case the outsphere is the familiar 
Bloch sphere, which is identical to the boundary of the body of density matrices. 
Note furthermore that the relations 

{e^\ej) = , e, • = ^6,^j - ^ (1.87) 

imply each other. If \ei) is an orthonormal basis of kets, the corresponding vectors 
form a regular simplex that spans an {N — l)-plane, and clearly 



^e, = 0. (1.8 



i=0 
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Hence the simplex is centered at the origin. We have normahzed its edge lengths 
to unity. 

Next consider two MUB with kets \ei) and respectively, represented by the 
vectors and fj. The two equations 

|(e.|/j)|' = ^, e,.f,=0 (1.89) 

are equivalent ways of stating that the bases are MU and, therefore, the two planes 
spanned by a pair of MUB are totally orthogonal: Each vector in one plane is 
orthogonal to all vectors in the other plane. Since the dimension of our space is 
iV^ - 1 ^ (iV + l)(iV - 1), we can fit at most + 1 totally orthogonal {N - 1)- 
planes into it. This is one way of seeing that the maximal number of MUB is iV+ 1. 

Let us now momentarily forget that our vectors e^, f^, and so on, are supposed 
to come from unit vectors in Hilbert space. Whatever the value of A^, we can always 
find TV + 1 totally orthogonal (A'' — l)-planes in and if we place a regular 

simplex in each we will obtain a quite interesting convex polytope with N{N + 1) 
vertices.f^Sl When = 2, it is in fact a regular octahedron, but for other values of 
A^ it needs a name of its own. We will call it the MUB polytope, without implying 
that there exists a maximal set of MUB in the A^-dimensional Hilbert space. The 
MUB polytope and the body of density matrices share the same outsphere and, 
in this manner, the existence problem for MUB can be turned into the problem 
of rotating the MUB polytope in such a way that all its vertices fit into the small 
subset of pure quantum states that are present in that outsphere. This is a hard 
problem (unless A^ = 2). Indeed, from this perspective it is not obvious that we 
can find even one pair of MUB but, as we have seen in Sec. 11.1.21 we can always do 
this. It is the existence of a maximal set, with A^ + 1 bases that are pairwise MU, 
which is in doubt for general A'^. 

Viewing bases as (A^ — l)-planes in R'^ gives us the means to quantify how 
close a given pair of bases is to being MU. The trick is to regard n-planes in R™ 
as rank-n projectors in a vector space of real m x m matrices, in analogy to the 
way we go from vectors in Hilbert space to density matrices. This gives us an 
embedding of the Grassmannian of n-planes into a fiat vector space equipped with 
a natural euclidean distance, and hence a natural notion of distance between vectors 
in Hilbert space. To derive it, consider the A^ vectors e^. Then form the (A'^ — 1) x A^ 
matrix 

B = [ei 62 ... gat] . (1.90) 

It has rank A^ — 1 because of (|1.88|) . Next form the projector onto the (A^— l)-plane 
spanned by the linearly dependent vectors e^. It is 

n = 2BS'^. (1.91) 

Finally, the square of the chordal Grassmannian distance between a pair of planes 
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iP3 

D^iu^.Uff ^ itr{(ne - n^)^} ^N-i^Y. (\i^a\h)\' - 

-J2\(^a\h)\\l^\{ea\h)\'), (1.92) 

a,b 

where the kets jca) are related to He through (|1.85p . (jl.90p . and (11.911) . and the kets 
\fb) are analogously related to 11/. The last expression of (|1.92l) shows that Dc — 
if the projectors \fb){fb\ are a permutation of the projectors |ea)(ea|, in which case 
we have the same basis twice, possibly with different labeling. 
One can check that 

0<D'^<N~1, (1.93) 

and that the distance is maximal if and only if the two bases are MU. This notion of 
distance has been used to study packing problems for n-planesf^Sl and as a measure 
of "MUness".'23if 

we pick our bases at random, using the unitarily invariant Fubini- 
Study measure to define "random," we find that the average squared distance is 
given by 

iD'c)FS-^iN~l). (1.94) 

If the dimension is large, iV ^ 1, two bases picked at random are likely to be almost 
MU. Let us finally mention that entropic uncertainty relations in effect provide an 
interesting alternative measure of "MUness" .ISlHlIl 



2. Construction of mutually unbiased bases in prime power 
dimensions 

2.1. Galois fields 

In what follows, we work in a Hilbert space of prime power dimension N — p" with 
p a prime number and M a positive integer. These are the dimensions for which 
maximal sets of MUB are known to exist. Moreover, and not coincidentally, there 
is a finite Galois field with N = elements. We shall label these elements by 
integer numbers i, < i < iV — 1, or, equivalently, by M-tuples (?o, ii, • ■ • , «m-i) of 
integers, each integer running from to p — 1. that we get from the p-ary expansion 
of i: 

M-l 

i = (io,ii,...,iM-i) if i = ^i„p". (2.1) 

n=0 

Each field is characterized by two operations, a multiplication and an addition, 
that we shall denote by and © respectively. As in footnote ta[, we shall use the 
symbols and 1 for the neutral elements of addition and multiplication, respectively, 
throughout the paper, consistent with their meaning as integers. 
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Further, we adopt the particular convention that the elements of the field are 
labeled in such a way that the addition is equivalent to the component-wise addition 
modulo p, that is 

i = j ® /c is tantamount to z„ — j„ + /c„ (mod p) (2-2) 

for n = 0, 1,...,M — 1, where in,jn, kn are the respective coefficients of ()2.ip . As a 
consequence, the summation in (|2.1|) is also a field summation, 

M-l 

I = («o/) © {iip') © • • • © («M-ip"'~') = . (2.3) 

n=0 

All fields with the same number of elements are equivalent up to a relabeling, 
and there is no strict obligation for the convention (|2.2|) . but it is natural and 
convenient in the present context, because it allows us to regard the elements of 
the field both as labels of basis states and as integer numbers that we can use for 
getting powers of complex numbers in accordance with the usual computation rules. 

Actually, that there exists a relabeling such that the addition is equivalent to 
the addition modulo p component-wise is a direct consequence of the fact that for 
all finite fields the characteristics of the field — the smallest number of times that 
we must add the element 1 (neutral for the multiplication) to itself before we obtain 
the element (neutral for the addition) — is always equal to a prime number {p 
when N = p^'). 

Unfortunately, there is no similarly simple convention for the field multiplica- 
tion 0, and — the exceptions N — p and iV = 4 aside — one has a choice between 
several equally good ways of defining the field multiplication such that it is con- 
sistent with the component- wise definition of the field addition ©. In view of the 
associative and distributive nature of 0, that is: (a 6) c — a (5 c) and 
{a (B b) Q c — (a c) (6 c) , respectively, we only need to state the values of 
p' p'^, the products of powers of p, with j. A; = 0, 1, . . . , M — 1. 

For M = 1, N = p, the field multiplication is just multiplication modulo p. For 
M > 1, we have the Galois construction 

p]+k a j + k < M, 

M-l 

©P" = ^ Zl^'P' = (^0:Mi,---,A'm-i) ifj + fc = M, (2.4) 

(=0 

pQ {p'~^ Q p^) recursively, if j + fc > M . 

Hereby, the coefficients that define the j + fc = M products are restricted by the 
requirement that 

M — 1 

x"" -^^llX^ (2.5) 

1=0 

is an irreducible polynomial over the Galois field with p elements, which is to say 
that it cannot be factored into two nonconstant polynomials whose coefficients are 
modulo-p integers. 
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In a standard textbook parameterization of the Galois field with N = p" ele- 
mentsp2] one identifies the field elements with polynomials that are defined by the 
coefficients of the p-ary expansion of (|2.1[) . 

M— 1 

i = (io,»i, ■ • ■ ,iM-i) < — y^imx"". (2.6) 

Addition and multiplication of the field elements are then carried out as addi- 
tion and multiplication of the corresponding polynomials modulo the polynomial of 
(|2.5p , with the resulting sums and products stated as polynomials of degree M—1 
with modulo-p integer coefficients. Clearly, this gives the component-wise addition 
of (12. 2p and multiplication in accordance with (|2.4I) . Since the field multiplication 
is not familiar to readers with a typical theoretical-physics background, we now 
discuss it in some detail. 

For instance, the choice 2 2 = 3 is unique for = 4, and for p odd and 
N — p^ , one can always choose pQ p = /Iq with /Iq not a square, such as 3 3 = 2, 
505 = 2 or 505 = 3, 707 = 3 or 707 = 5 or 707 = 6, and so forth. For higher 
powers of p = 2, there are several choices too; they include 2 4 = 5 for = 8, 
2 8 = 3 for A^ = 16, and 2 16 = 5 for iV = 32. 

As a final example, we mention 3 9 = (1, 2, 2) = 25 for A^ = 3"^Ii3 This implies 
first 9 9 = (2, 2, 0) = 8 and then 

AT = 27 : (ao,ai,a2) (60,61,62) = a0 6 = c = (co,ci,C2) 

with Co = flo^o + 0162 + 0261 — 0262 (mod 3) , (2-7) 
ci = ao6i + ai6o - aih - o-ibi — 0262 (mod 3) , 
C2 = 0062 + ai6i -I- 0260 — 0162 — 0261 (mod 3) , 

for the multiplication of two arbitrary field elements. The special cases 3 13 = 1 
and 9 17= 1 may serve as illustrations. 
More generally, when writing 

p> / = (Af , m(-'"+'=) , . . . , M^tt^) , (2.8) 

we have 

Af^^+^-) = ^,+fe,,„ fori + fc = 0,l,...,M-l, and A^f^ = , (2.9) 

and the coefficients for j -I- fc = M + 1, M + 2, . . . , 2m — 2 are successively calculated 
with the aid of the recurrence relation 

Af(^+'=) = (1 - ^„,o)a4'-i'"'' + ^^m^4^-t^'^ (mod p) , (2.10) 

which is valid for j + k — 1,2,..., 2m— 2. The field product of two arbitrary elements 
is then given by 

a0 6= (aXo6^,aXi6^,...,aA^M_i6'^) , (2.11) 

''The choice 309 = 25 is the largest one of the eight permissible values. The other seven values for 
i^iQ,^ll,^l2) are (1,1,0) = 4, (2,1,0) = 5, (2,0,1) = 11, (1,1,1) = 13, (2,2,1) = 17, (1,0,2) = 19, 
and (2, 1, 2) = 23. Each of them yields a consistent implementation of the field multiplication. 
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where M.^ = the symmetric M x m matrix 



M, 
M, 



(1) 

m 
(2) 



(1) 

m 
(2) 



(2) 



V 



fl^(2M-4) ,^(2M-3) 



, (2.12) 



7 



and in the products aM-mb^ we regard a = (ao,ai,...) as a row of p-ary coef- 
ficients and 6"^ as a column. These row x matrix x column products are ordinary 
matrix products with the outcome evaluated modulo p. The matrices M.q, Mi, . . . , 
M.^^_i are invertible, in the sense of modulo-p arithmetic, because there is a unique 
multiplicative inverse for each non-zero field element. For instance, we have 



and 





Ml 



Mi^ = 




M, 




(2.13) 





(2.14) 



for the TV = 27 example in (pTfj) . 

Having thus established how the field addition a © 6 and the field multiplication 
a© 6 are implemented for any two field elements a, 6 = 0, 1, . . . , — 1 with iV = 
we can put the Galois field to use. For notational simplicity, let us denote by 7 the 
basic pth root of unity. 



7 



(2.15) 



rather than writing 7^ as in (|1.4p . Exponentiating 7 with elements g of the field — 
regarding now, as noted above, the field elements as integers — we obtain complex 
phase factors of the type 7^ with < 17 < — 1 . As g is an integer, such phase 
factors can take on only p different values, which are completely determined by the 
first component of the p-ary expansion of g, 



M— 1 



for .9 = 51 



dnrP 



(2.16) 



because g^ is just the remainder of g when dividing by p in the usual sense. The 
phase factor 7^ can be considered as a p-tuple generalization of the (binary) parity 



operation e 



i(27r/2)g 



(—1)^ of the q-bit case (that is p = 2). 
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The following identity plays a fundamental role: 

^ y = iV<5,,o . (2.17) 

3=0 

N-1 N-1 

Indeed, if i = 0, then ^ 7-'®* = ^ 1 = . Otherwise, 

j=o j=o 

N-1 N-1 

1^0 : = E (2.18) 

j=0 j'=0 

because the field multiplication is invertible, and then 

N-1 p-1 , _ p. 

where the first step exploits (|2.16p and recognizes that there are p^^~^ field elements 
j' with the same value of Jq. 

The fact that the field addition is the component- wise addition modulo p, com- 
bined with the rule (|2.16p . implies the following useful identity: 

= 'y*+-J' = ryio+30 ^ ^{^®3)o ^ ^i®3 _ (2.20) 

In the final expression on the right, the sum i © j is the Galois sum of i and j, 
which is then regarded as an integer, just as we regard the result of the Galois 
multiplication j i in (|2.17l) and (|2.18l) as an integer, and so get integer powers of 
7. Relation (|2.20p expresses, in the language of mathematicians, that the pth roots 
of unity are additive characters of the Galois field.!^ 

It is important to note, in order to avoid confusions, that different types of 
operations are present at this level: The internal field operations (© and ©) must 
not be confused with the modulo- operations. As an illustration of the differences 
between these operations, we consider the case p = 2, M = 2, = = 4 and give 
the tables for field addition (©) and field multiplication (©) in Table [lla) as well 
as the tables for modulo- addition and multiplication (©4 and ©4, respectively) 
in Table HKb). 

One can check that the field and modulo-4 multiplications are distributive with 
respect to the associated addition, but that there are no non-zero dividers of 
only in the case of the field multiplication, whereas we have = 2 ©4 2 for the 
modulo-4 multiplication. As a consequence, the field multiplication table exhibits 
an invertible group structure when the first line and first column are removed. All 
operations are commutative as can be seen from the invariance of all four tables 
under transposition. 
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Table 1. (a) Addition and multiplication tables for the field with N = A 
elements, (b) Addition and multiplication modulo N = A. 
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Let us express q-quarts as products of two q-bits, in accordance with the binary 
encoding oi i ~ {ig, ii) for i = 0, 1, 2, 3 as stated by 



«)4 = No>2® Ni)2 : 10)4 = 


10)2'? 


5 10)2, 




|1>4 = 


|1>2§ 


5 10)2, 




|2>4- 


10)2 § 


5|1>2, 




|3>4- 


|1>2§ 


5 11)2. 


(2.21) 



With the aid of the ® subtable in Table [TJ it is easy to verify that 

= No ©2^0)2 (S \ii ®2ii)2 
for i = (io,ii) and j = (jo, ji) ■ (2.22) 

This illustrates that the field addition is equivalent to the component-wise modulo-p 
addition. 

It is also worth reminding that the properties 

N-l 

iWn=iT' and Y.^f'^'^^^i^^ (2-23) 

with — e^^'^/^ as in (|1.4[) are true for the modulo- iV addition and multiplication 
as well, but note that is the basic iVth root of unity in these analogs of (|2.20p 
and (|2.17[) . In prime dimensions (m = 1^ N = = p) we have 7 = 7Ar so that 
the characteristics of the modulo-p ring and the Galois field coincide. Indeed, both 
structures are rigorously identical in prime dimensions. In prime-power but non- 
prime dimensions, for instance when iV = 4, this is not true. 



2.2. The computational basis 

Consider now a quantum degree of freedom of prime-power dimension N = p" — 
a q-nit composed of M q-pits. The corresponding Hilbert space of kets has a conve- 
niently chosen orthonormal reference basis consisting of |0), . . . , — 1), which 
we regard as the computational basis of kets. The adjoint basis of bras comprises all 
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(n| = |n)^ with n = 0, 1, . . . , iV — 1. As usual, the inner products ( • , • ) of two kets 
or two bras are given by Dirac brackets (= bra- kets), for which the orthonormahty 
relations 

(N),b-)) = ((*l,01) = (*b)='5., (2.24) 
are an elementary illustration. 



2.3. The dual basis 

Let us now consider the unitary transformations that shift each label of the 
states of the computational basis {|0), |1), . . . , . . . , |iV — 1)} by /, 

\i)^V°\i) = \i(Bl), (2.25) 

so that each implements a permutation among the kets of the computational 
basis, but does not change the basis as a whole. The shift in (|2.25p is a shift modulo 
N in prime dimensions only {N=p) and then is identical with of Sec. 11.1.21 
in prime power dimensions (N = p^', M > 1) the shift consists of M shifts modulo p, 
component-wise. The transformations effected by with ^ = 0, 1, . . . , iV — 1 make 
up a commutative group of permutations with N elements that is isomorphic to 
the Galois addition. 

Generalizing the procedure outlined in Ref. [SSj we employ a suitable discrete 
Fourier-type transformation — the inverse Galois-Fourier transformation — to 
define the dual basis as follows: 

N-l 

1^') ^TmT. I^)^'"'"'' (2.26) 



fc=0 

where the symbol G represents the inverse of the Galois addition ©, that is: x = Qy 
ii x(By = 0. It is easy to check that these dual kets are joint eigenkets of the unitary 
permutation operators Vj". Indeed, we have 

w-i 



V * 7 — n 



L^|fc')^e(fc'eO0.^ 1,^)^0., (2.27) 

k'=0 

which identifies the eigenvalues 7'®-' . These are p different eigenvalues, each occur- 
ring times. 

Obviously, the dual basis and the computational basis are MU by construction, 

2 



|(J»|' = 



for all J, fc = 0,1,..., TV- 1. (2.28) 



/TV 

When the dimension is prime {N = p), the dual basis is the standard discrete 
Fourier transform of the computational basis, as in (|1.6p : when iV is a power of 2, 
the Galois-Fourier transform is a real Hadamard transform.!^ 
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Let US denote by Vj the unitary transformations that shift each label of the 
states of the dual basis {|0), . . . , . . . , |iV - 1)} by 0/, 

\i)->V^\i)^\iel), (i\->{i\V^^{i®l\, (2.29) 

so that each implements a permutation among the kets of the dual basis, but does 
not change the basis as a whole. In perfect analogy with the permutation operators 
V;° of ^(TM . the transformations effected by with I = . . . ,N - I upon the 
bras (i| also compose a commutative group of permutations with N elements that 
is isomorphic to the Galois addition. 

These permutation operators are diagonal in the computational basis, 

AT-l N-l 

= = E ■ (2.30) 

fc=0 fc=0 

This is the dual counterpart of the analogous expression for the shifts in the com- 
putational basis, 

N-l N-l 
fc=0 fe=0 

which is equivalent to (|2.27p and follows from that eigenket statement. 

The unitary operators and Vq are obviously analogs of the operators and 
of Sec. 11.1.21 but for M > 1 these operators are markedly different. In particular, 
the period of and Vq is p, not N = p". We indicate the difference by writing (i| 
for the dual basis here, whereas the notation ( « | is employed in Sec. 11.1.21 

As mentioned above, it is immediately clear that |fc) — > Vf'lk) ~ \k (B I) is 
a component- wise addition, where the components of the q-nit ket \k) are the M 
q-pits that compose it, as is illustrated by (j2.2ip and (j2.22l) for p = 2 and M = 2. 
More generally, 

V°\k) = ■t^/°(|A:o) |fci) • • • ® |fcM-i)) 

= \kQ + Iq) ^ \ki + h) (g) ■ ■ ■ (g) |/cm-i + Im~i) , (2.32) 

where each factor |A;,„) in the tensor product is a q-pit ket, and the sums km + lm are 
modulo-p sums. It follows that Vj^ is a product of factors, each of which referring 
to one of the q-pits, 

M— 1 

V," = {V,T {Vp't {y^^t • • - n (^P-)'" ' (2-33) 

where the mth factor affects the mth q-pit only, with Vpm giving a unit shift of the 
mth modulo-p label. 
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In order to see that {k\Vo — © ^1 is a q-pit-wise shift as well, we first 

observe that the Galois-Fourier transformation ()2.26p factorizes, 



AT-l 



N-1 



1 ^,(.><oWo^,.„|^ 1 
V^jo=0 ji=0 

{ko\ ^ {ki\ ^ ■ ■ ■ ® ik^il , 



(kMo)i3i ^^-^1 



(2.34) 



where A^o is the 0th multiplication matrix in (|2.11l) and is the mth component 
of kMo = {k^,ki, ■ ■ ■)■ Since A^o is invertible, we can parameterize the field element 
k in terms of the coefficients k^ , 



^ ^ (^0' — 1 1 • • O-^o ^ikQ,k^,-- 



( \ 

.91 

\5m-i/ 



M-l 



(2.35) 



m— 



with the field elements Qm defined such that their p-ary coefficients make up the 
rows of the M x M matrix M'^^ ■ Alternatively, we could define the by their 
basic property 



J a m — n , 
1 ii m ^ n . 



(2.36) 



Therefore, a unit increase of fc„j means the addition of gm to k, and the shift 
operator Vq factorizes accordingly into a product of powers of single-q-pit Fourier 
operators, each of which (the mth, say) acting on the single-q-pit bras {jm\ only 
and leaving the other M — 1 q-pit bras in the products of (I2.34p unaffected. 



M-l 



= (V°)-" iVo'')-' iVo'n-' • • • = n (^0"")-'" . 



m=0 



with the mth factor affecting the mth q-pit only. 



(2.37) 



(2.38) 



For instance, we have go = 1, gi — 12, gi ~ 3, and fcg — fco, k^ = fc2, k_2 — k\ — ki 
for the iV = 27 example of dSj]), dUS]), and (|2A4)) . 

The respective unitary operator factors for unit shifts in (12.33^ and (|2.37p com- 
mute if they refer to different q-pits. 



(2.39) 



which essentially states that the Galois shifts with their component-wise addition 
are consistent with the factorization of the N — p^'-diniensional degree of freedom 
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into M p-dimensional degrees of freedom, as discussed in Sec. ll.1.51 And for the pair 
of operators to the same q-pit, one easily verifies the Weyl commutation rule 

^p^^^o'" ^T-Vo^-F,"™. (2.40) 

Equations (|2.39l) and (|2.40p are particular cases of (|2.42p below. 

2.4. Construction of the remaining N-1 mutually unbiased bases 

In the previous section we established a pair of MUB, the computational basis, 
which can be chosen arbitrarily, and its dual basis, defined by (|2.26p . In this section, 
we shall generalize this construction in order to obtain the other — 1 bases that 
complement the computational basis and its dual basis such that the bases of each 
of the N{N + l)/2 pairs are MU. 

2.4.1. Heisenberg-Weyl group 

Let us denote by the compositions of the shifts in the computational and the 
dual bases, obtained by ordinary operator multiplication of and , 

y/ = V^Jy^o = ^ |fc©i)7(fe®')©J(fc| fori,i==0,l,...,iV-l, (2.41) 

k=Q 

the building blocks of the Heisenberg-Weyl group. This is consistent with the pre- 
vious expressions for i = or j = because V^" is the identity. In particular, for 
i = and j = I we get the second sum of p.30p . and for i — I and j = we have 
the first sum of (jOTI) . 

We note that the order of multiplication of Vq and Vj' matters in the definition 
(|2.4ip because these unitary shift operators do not commute, 

= 7®^°^'^d' V^." ■ (2-42) 

We recognize here the Weyl commutation rule for the two unitary operators Vq 
and V^, which is their basic algebraic relation.'^ll^l 

In dimension N = p = 2, the commutation relation (|2.42p is that of the Pauli 
group (identify Vq with ax and with CTz once more). When the dimension is 
a prime number, the field operations are the addition and multiplication modulo 
p, and the properties of MUB are well-knownpl recall the discussion in Sec. 11.1.61 
with its emphasis on the Heisenberg-Weyl group. 

Currently, we consider the Heisenberg-Weyl group associated with the Galois 
addition and multiplication rather than the Heisenberg-Weyl group associated with 
the usual modulo-A'^ operations. These groups coincide in prime dimensions but 
differ for non-prime but prime-power dimensions. Notably, the Galois field is iso- 
morphic to the modulo- A ring in prime dimensions only (A^ = p). Nevertheless, 
the Heisenberg-Weyl group factorizes in dimension p^' into products of operators 
that belong to the local q-pit Heisenberg-Weyl group. In the case of translations 
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of the computational basis, the factorization is straightforward and given above in 
(|2.33p . And in the case of translations of the dual basis, where the mapping from 
global operator labels to local operator labels is more intricate, see (|2.34p - (|2.36l) . 
the factorization is stated in (I2.37[) . 

The composition law of the N'^ unitary operators introduced in (|2.4ip is 

= ^^^^'V^V^Vy,' = 7^^°'^/et , (2-43) 



which implies 



and 



Vr = Vi'^j^'^^^Vil (2.44) 



V^VfVl'^ = ^^(SiejQkyj (2.45) 
for example. Another implication is 

l+2+--- + (p-l) ^ . , ip(p_i) 



(-l)'Qn forp = 2, 

1 for p== 3,5,7,11,. 



(2.46) 



which is reminiscent of (|1.20p and once again shows a difference between the single 
even prime p — 2 and the odd primes p > 2. 

Yet another implication is the orthonormality relation for the Vfs, with respect 
to the Hilbert-Schmidt inner product, 

(Vi, Vl) = tr{vfvi} = NS.,,S,, , (2.47) 

because all V/s are traceless, except Vq = 1. The other side of this coin is the 
relation 

1 1 

^ V-AV-^ = -tT{A}l, (2.48) 

m.n—Q 

which one may regard as a manifestation of Schur's lemma, inasmuch as the right- 
hand side follows after observing that the sum on the left commutes with all VJ 
and must therefore be a multiple of the identity. Schwingeil^ calls such statements 
about equal-weight averages over the whole phase space ergodic relations. 

Equation (|2.43p is the discrete analog of the familiar Baker-Campbell-Hausdorff 
relation for exponentiated position and momentum operators that we encountered 
in (ll.34p . An immediate consequence of (I2.43P is 

Vivl" = Vi'Vi if {i fc)o = (j Oo and only then, (2.49) 

where ( )o has the same meaning as in ()2.20p . In particular, (|2.49p is fulfilled if 
i Q k — j Q I, which we note for later reference. 
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2.4.2. Abelian subgroups 

Up to a global phase, (|2.43|) looks like a group composition law. Indeed, one can 
sho'vJsS! that there is a true analog of what we observed in Sec. 11.1.61 for prime N: 
The N'^ unitary operators V/ with i, j = 0,1, . . . , N — 1 make up + 1 commuting 
sets (abelian subgroups of the Heisenberg-Weyl group) of N elements each that 
have only the identity Vq in common. For each of these commuting sets, there is 
a basis of joint eigenkets of all V/s in the set. The + 1 bases thus identified 
are pairwise MU. In passing, we note that this property can be shown, following 
an alternative approach developed in Ref. [35l to be a consequence of the fact that 
the V^/ operators form what is called "a maximally commuting basis of orthogonal 
unitary matrices." 

It is expedient to introduce a fitting notation and terminology before we proceed. 
We shall denote by C// the elements of these abelian subgroups, where i labels the 
subgroup and runs from to to account for + 1 subgroups, while I labels the 
N elements in the subgroup and runs from to A^ — 1. For the basis kets associated 
with the subgroups we use the convention that the fcth basis ket for the ith subgroup 
is denoted by |e^). 

The abelian subgroups for i = A^ and i = are composed of the two sets of 
commuting operators of Sec. 12.31 respectively. 



JV-l N-l 



fc=0 fc=0 
N~l N-1 

= V,"=Y: \k)l'^'Ck\ ^ E , (2.50) 



fc=0 fc=0 



with / = 0, 1, . . . , A^ — 1. As indicated, we identify \k) with |e^), and |fc) with \e1). 
In other words, we choose the convention that the computational basis is the A^th 
basis, and the dual basis is the 0th basis. 

This suggests strongly that the other A^ — 1 sets can be chosen such that 



N~l 



C/;-El4)7'°'(el| (2.51) 

fe=0 

with i = 1, 2, . . . , A^ — 1 and / = 0, 1, . . . , A^ — 1. To complete the picture, we need 
to find the kets \el), such that those with common label i make up orthonormal 
sets, and the sets with different i labels are MU. These requirements are compactly 
summarized by 

I - ,2 ^ ^ J 4,; for i = j (orthonormal), 

A [l/Niovi^j (mutually unbiased). 



which have to hold for i,j = 0, 1, 



,Af andfc,/ = 0, 1,...,A^-1. 
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Irrespective of the choice for the ith orthonormal set of kets and bras in (|2.51l) , 
the Ui are unitary and commute with each other for fixed i, 

UlUl,=Ul,Ul^Ul^i,, (2.53) 

which is an immediate consequence of distributivity and the identity ()2.20p . In view 
of (|2.49p . we can guess that the [// of the ith set are operators such that the 
Gafois ratio k(Z)l has the same i-dependent value for all of themQ For, if k(Z)l — k'Cdl' , 
then k' Q I = kOl', and (|2.49p implies that V;'^ and V^?' commute. 
We are thus invited to try the ansat^ 

f/;=ajV^*®' for i = 0,1,...,A^- 1, (2.54) 

where the phase factors a] have to be chosen consistently. In particular we have 

a? = 1 : Uj^ = Vi° for / = 0, 1, . . . , iV - 1 

and aj, = 1 : C/q = for i = 0, 1, . . . , - 1 , (2.55) 

and the said consistency with (|2.53p requires 

"fc"; = "fcezT , (2-56) 

where (|2?20l) and ([2^ have been used repeatedly. We note that all [//s of (f230l) 
and ()2.5ip have period p, which tells us that the inclusion of a] in ()2.54|) removes 
the even-odd distinction of (j2.46|) . 

The orthonormality relation (|2.47|) carries over to the C//s in the form 

r N for fc = / = , 
tr{C/f f//} = N6kAek,3ei = { Nd.^j for fc = / ^ , (2.57) 

[ for fc 7^ / . 

This is, of course, (|1.5|) in the present context. 

Any choice for the phase factors a] that obeys (|2.55p and (|2.56p is permissible 
in ()2.54p , but these conditions do not determine the phase factors uniquely (except 
for i = 0). Just as ()2.53|) remains valid when we replace U[ by ^^^'^^Ul with an 
arbitrary field element 6^0 the replacement a\ — ^ a|7^'®' has no effect in (j2.55p 
and (I2.56|) . and in (|2.54p it amounts to a permutation of the states in the ith basis: 
\e\) — > |e|,Qb.), but leaves the basis as a whole unchanged.'^ Indeed, irrespective 
of the particular choice made for the phase factors in (I2.54p . the set of common 
eigenkets \e\) of the N unitary operators in the ith abelian subgroup must always 
be the same — a different phase convention can only result in a different labeling 
of the eigenkets. 

It remains to be shown, though, that there are consistent choices for all phase 
factors. This task has been completed in Ref. [HH from where we take the following 
explicit solutions. 

'For I 7^ 0, one naturally defines k Q) I hy {k (Z> I) & I = k. 

jpor N = p odd, we make contact with Sec. ll.l.6l for (7/ = {XZ^Y, that is a\ = ■y-u(l+l)/2^ 
Analogously, we could introduce a phase factor 

gi6(a, P)t |ji:44|| without affecting JTlSJl. 
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In odd prime-power dimensions (p = 3,5,7,...), where 1 ® 1 = 2, the self- 
suggesting choic^ 

podd: aj = ^e(»0ioO02 (2.58) 

is simplest and indeed possible. But in even prime-power dimensions (p = 2), where 
1 ® 1 = 7^ 2, (1^35)) does not work. 

That the situation is more complicated for p — 2 could perhaps be anticipated 
because finite fields with even and odd cardinality are known to possess very differ- 
ent structures. In the present context, the structural difference between p = 2 and 
p — 3,5,7, . . . manifests itself in the observation that 

/ xp f = 1 or -1 forp = 2, 

M = . (2.59) 

^ ^ [1 for p > 2 , 

which combines with (|2.46p to ensure the p-periodicity of all [//s. As a consequence, 
we can systematically write aj as a power of 7 for odd p, as we do in (|2.58p . For 
p = 2 this is not possible but, instead, we can systematically write aj as a power 
of i = \/— 1 = e'"2 because, in virtue of (j2.59|) . aj is the square root of a power of 
7 = — 1 for p = 2. 

Now, such a square root is only determined up to a global sign. Some extra work 
is thus necessary in order to fix these signs, which will enable us to derive a. p = 2 
counterpart of (|2.58p . As a consequence of the group property (|2.56p . for each j it 
is sufficient to fix M well chosen phases such that then the values of all the N — 2" 
phases are determined. 

The M values of the signs of the phases aj that we choose by convention are 
a{,a2, ■ ■ ■ , ct^"-^ ^^^'^ require, in agreement with (I2.59p . that they obey 

p = 2: ai. = iJ02"O2" or a^'^2„ = p0('"2")0(i„2") ^ (2.6O) 
where the latter version, with In — or In — I, incorporates ag = 1 as well. For 

M— 1 M— 1 

/ = 5^ Z„2" = Z„2" , (2.61) 

n=0 71=0 

we then have two ways of evaluating the product of all af s, namely 

M— 1 M— 1 

n <2" = n i^®('"'"^®('"'"^ (2.62) 



ra=0 71=0 



'Note that I Q I 2 = l{l + p)/2 (mod p) for TV = p odd. 
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as an immediate consequence of (j2.60l) . and 

M— 1 M— 1 

n=2 

- V"0'oO(ii2)/ -|y0(ioeii2)0(i22") i TT 



n=0 



M — 1 



J 

2" 



n=3 

M — 2 M— 1 

n n (-iF®^''"^'")®^'"^") (2.63) 

m— n— m+1 



or 



n <2" = n (-i)^"®('"'^'")®('"^") (2.64) 

n— m,n— 

by repeated application of (j2.56p . The n = m terms missing in f|2.64p make up the 
product in (|2.62p , so that we arrive a 

M — 1 

m.n—O 

as the suitable square root of (—1)-'®'®'. The additional option of replacing aj by 
rybjQifj^j^ see the paragraph after (|2.57l) . amounts to extra factors of (—1)'" in (I2.60p 
for some n values. Examples of evaluating the product in (j2.65l) can be found in 
[Appendix D[ 

Irrespective of the conventions adopted for the phase factors a], we note that 
the symmetry property 



(2.66) 



holds when N is even, because I = Ql ior p = 2. It is also true for odd N if the 
phases of (|2.58l) are chosen, but not for all permissible choices. If one imposes (|2.66p 
as an additional condition, then 

(aO' = a?a^,=7®'®'°' (2.67) 

for all N and all i = 0,1, . . . , N — 1, and (|2.58p and (|2.65p show how the proper 
square root of the right-hand side can be defined. Unless explicitly stated, the 
symmetry (|2.66p is not assumed for p > 2 in what follows, and neither are the 
explicit expressions (|2.58p and ()2.65p for the phase factors. 



™Owing to an oversight that was pointed out by Eusebi and Mancini,Ell the expression given in 
Ref.|34'is incorrect, but this inadvertence is of no consequence because the general properties l|2.55|l 
and 1 12. 561 1 matter, not the exphcit convention chosen for the values of the ajs. The derivation 
H2.60|l - I|2.65|l is essentially identical with the reasoning in Ref. 1361 
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2.4.3. The remaining N — 1 bases 

Having thus at our disposal the unitary operators J7/ of p.5ip and (|2.54|) . we can 
also state quite explicitly the — 1 bases associated with the abelian subgroups 
for i = 1, 2, . . . , — 1. For this purpose we exploit the analog of ()1.12p . 

N-l 

\el){el\^jjY.^''''''Ui, (2.68) 
;=o 

which is an immediate consequence of (j2.5ip and (j2.17l) . and from its implication 

(eneD(el|e^:) = ^ (7'®'«^eO* (7'®"«^e™) (2-69) 

we find 

14) = ^ El^r^)^""'®'"©; ■ (2-70) 

^ 1=0 

As a consequence, the unitary shift operators V^] of the Heisenberg-Weyl group, 
turn states of one basis into each other, but do not relate the bases to one another, 

Cleo) = |e^0™eJ"m for z = 0, 1, . . . , TV - 1 , Ck^) = lO ■ (2-71) 

Statements ((2:69)) . (|2J0)) . and ((2TT|) . as well as ((2J4| - ((2J7|) below, are vahd 
both for odd prime powers and even prime powers, whether the respective phase 
factors of (I2.58P and (|2.65p are used or any other permissible choice, and apply also 
for i = Q when jej!) = \k) as required by the conventions chosen in (|2.50p and ()2.55p . 

Indeed, it is easy to establish the validity of the requirement (|2.52p for the 
projectors in ()2.68p by just exploiting ()2.68p itself and without relying on (|2.70p : 

N~l 

\{el\ei)\' = tr{{\el){el\){\ei){ei\)}^— ^ 7'=°™7®'°"tr{C/;,Vi^} 

m,n— 

N-l N-l 

m,n— m— 

1 1 ^"^ 1 / I 

m=l ^ 

where the orthonormality relation (|2.57p and the identity (|2.17p are the main in- 
gredients. The eigenvalue equations 

Ui\el){el\ = \e^{e^\Ul = \el)j'^'''{el\ (2.73) 

also follow for ^^M^ directly from (f233l) . 

But it cannot be a mistake to check, for consistency, that |e^) as given in p.70p 
is the eigenket of U[ of (|2.54p to eigenvalue --y*'®'. Starting from 

= |to ® Oae(m©o* "em (2-74) 
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we have 



m— 
N-1 



Qm 



= ^ E I- ® 0«e(™eO* T^^'"®'^^"^ = Wk) , (2.75) 



indeed. 

For later reference, we further observe that 



tr{C/f TC} = N5^Qi,n Sun af , (2-76) 
which follows from p.54p and (|2.47l) and in turn implies 

(4ldel)=<5.0,„,„7'°'"<*, (2.77) 



upon invoking the adjoint version of p.68p . And finally we note that the unitary 
mapping of the computational basis {i — N) onto the iih basis is accomplished by 
the Clifford operator C,; whose defining property, that is: Ci\e^) = |e^.) for all k, 
implies 

a:=El4)(^^l- (2-78) 

k=0 

This includes Cn = 1. The terminology "Clifford operators" refers to the Clifford 
group,!^ which consists of all unitary operators that map the Heisenberg-Weyl 
group onto itself under conjugation, that is: VJ' — > C^VJ*C equals one of the VJ*s for 
each C in the Clifford group, in full analogy to the discussion in Sec. Il.f .41 



2.5. Complementary period-N observables 

In a sense, the A^+1 abelian subgroups replace the N+1 complementary observables 
of Sec. 11.1.61 whose powers constitute the iV + 1 abelian subgroups for prime N . 
But there are much closer analogs in the form of + 1 pairwise complementary 
period- iV observables for which (jl.Sp applies immediately, rather than the analog 
we have in (|2.57|) . 

For each abelian subgroup, z = 0, 1, 2, . . . , iV, we introduce a period- iV observ- 
able by means of 

N-l N-l 

Z^=Y. I4)7^(el| = ]^ E 7^7^'°'t^; . (2.79) 

fc=0 fc,/=0 

By construction, these observables constitute a maximal set of pairwise complemen- 
tary observables for the TV-dimensional degree of freedom. See Table [2] in Sec. 15.71 
for an example of five such observables for = 4. 
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3. Generalized Bell states and their applications 

There is a one-to-one correspondence between the elements of an orthonormal basis 
of generalized Bell states and the Heisenberg-Weyl group of unitary transforma- 
tionsP^'^'^ This correspondence is a key concept for a uniform view of several 
important applications in quantum information science, such as quantum dense 
coding (Sec. 13. 2p . quantum teleportation (Sec. 13. 3p . quantum cloning (Sec. 13. 4p . 
and entanglement swapping fSec. 13. 5|) . 

The construction that we use here employs the Heisenberg-Weyl group of Sec. [2] 
whose shift operators p.4ip change state labels via field addition.laniill in the con- 
text of generalized Bell states, the analogous construction based on the modulo- 
Heisenberg-Weyl operators of Sec. 11.1.41 works equally well.^ With the necessary 
changes, all applications in Sees. 13.2143.51 can be implemented by these other Bell 
states.SS 

3.1. Generalized Bell states 

Following Refs. [33l |38l and |40l we can define the generalized Bell states by the 
following procedure. First, for all kets ji/') and bras {(j)\ we introduce conjugate kets 
1^/;*) and bras {<j)*\ whose defining property is 

{rw)^mY^m)- (3.1) 

Although this does not identify the conjugate kets and bras uniquely, any two 
implementations of the map — > \'ip*) are related to each other by a unitary 
transformation and, therefore, it does not matter which convention we employ for 
the implementation of our choosing. 

Since the conjugate kets transform like the original bras, we have a very useful 
one-to-one correspondence of one-q-nit operators ^-nd two-q-nit statesJB 

^ |0*,V^), (3.2) 

which is linear in both the ket part and the bra part of the one-q-nit operator. As 
a consequence, we have relations such as 

if A < — > \a) and B i — > \b), then tT{A^B} = {a\b) (3.3) 

as well as 

ifA< — > \a), then BA< — > {1(E) B)\a) (3.4) 

and 

HAi — > |a), then Afit ^ — ^ (s* (g, i)|a) ^ (3.5) 
where = if = lip). Take, for instance, 

A=|7^i)((/.i|^|a) = |0t,V'i) and S = 1^2) (02 1 ^ |&) = ^2) , (3.6) 

"In an experimental realization, the two different N-ary quantum degrees of freedom, the two 
q-nits, could just as well be carried by one physical object or by several. 
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for which 
as well as 

i?A=|V2)(02|^l)(0l| 

and 

AB^ = |Vl)(</'l|</'2)(V'2| - 



(0^|0^)(7^i|V'2) = (a|&) (3.7) 

|'^t>2)(<^2|V^l) = (l®|V2)(02|)|0t,V'l) (3.8) 

\r2,i^i){r2\ri) = (iV'2*)('/';i ® i) ■ (3.9) 



Quite generally, the mapping p.2p turns statements about one-q-nit operators into 
statements about two-q-nit kets. 

An important example is the observation that irrespective of the basis used in 
the completeness relation, the identity operator is mapped onto one and the same 

ket iBn n), 



J2\k){k\=Y,\el){el\ 



E 

k 



k*,k) 



E 

k 



|er,el) = |So.o>ViV, (3.10) 



k k 

here illustrated for the computational basis and either one of the bases of (I2.70p . The 
factor ^fN normalizes |-Boo) to unit length, consistent with (13. 3p and tr{l} = A^. 
Owing to its basis independence, the ket \Bq g) plays a central role in tomographic 
protocols for quantum key distribution; see, e.g., Refs. [4TH431 

While \Bqq) is basis independent in the sense of p.lOp for a given implemen- 
tation of the conjugation |^) — > li/i*), one should realize that different definitions 
of this map do result in different forms of |_Bq q) as expressed in the original bases. 
As an example, consider the case A^ = 2 of a single q-bit, and the following four 
alternative ways, four of many, of defining the map — > 



IV) = \Q)a+\l)P^\r) 
The respective two-q-bit kets |i?o,o)i 




(3.11) 



|i3oV = ^(|0*,0) + |lM)) 



V2 



(|0,0) + |1,1)), 



^(|0,0)-|1,1)), 



V2 



(|0,1) 



|i,o)), 
|i,o)). 



(3.12) 



are the familiar standard Bell states.!^ The four maps in p. lip differ by simple 
unitary transformations, and the same unitary transformations (of the first qubit) 
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relate the four Bell states to each other. For instance, tJz = |0)(0| — |1)(1| turns 
the first and second versions of jf/'*) into each other, and also the third and fourth 
versions. Likewise, cr^ (g) 1 interchanges the first and second Bell states, and the 
third and fourth. These observations for q-bits invite us to call \Bqq) a generalized 
Bell state. 

In view of V^" — 1, we recognize that N-^/'^V§ i — > |Bo,o)' which identifies 
|i?QQ) as one of the N"^ members of the set composed of the kets |i?m„) that 
correspond to the unitary shift operators 

N-l N-1 

C = E |fc®"^)7<'®"^°"(fc| ^ E |fc*,fc®m)7('=®'")0" = \B.^,JVn. (3.13) 

A;=0 fc=0 

These make up the set of generalized Bell states. Their orthonormality follows from 
(lO) and (Hil), 

{B^,n\B,^',n') = ^tT{V,lW;^,} = 5m,m'5n,n' , (3.14) 

and (|3.4p implies that the shift operators V^" permute the Bell states, 

(l®y/)|i3„,„) = |S„er,„®.)7^''^®"^ 
{Vr ® 1)|S„,„) = |S™e..ne.)7^"®'^^®^ , (3.15) 
where p.43p enters. In particular, we have 

|i3„,„) = (l®C)l^o,o), 
|i?e™.eJ = (C*®l)|So,o)7"®", (3-16) 

which relate all generalized Bell states to their "seed" \Bq q) of (|3.10p . 
We note the identity 

(yr®0|So,o) = 1^0,0), (3.17) 

which states the invariance of the seed under simultaneous shifts of both q-nits. 
And the analog of ((^^ is 

N-l 

^ ivr(^v;;,)\<t>\^)^\Bo,o)^{m, (3.18) 

m.n—0 

which once more emphasizes the particularity of the invariant Bell seed. 

Since all Bell states are related to the maximally entangled seed by a local 
unitary transformation ("local" because 1 (E) affects the second q-nit only in 
the two-q-nit state to which I-Bqo) I'efers), each of them is maximally entangled, 
and since they are orthonormal and iV^ in number, they constitute an orthonor- 
mal, maximally entangled basis in the Hilbert space of two-q-nit kets. Technically 
speaking, this A^'^-dimensional Hilbert space is obtained by taking the tensor prod- 
uct of the iV-dimensional Hilbert space, in which we have the computational basis 
and all that, with itself. 
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Owing to the correspondence |i?m,„) < — > N^^/^V^ in (I3.13p . the expansion 
of any A^-dimensional single-q-nit operator in the operator basis of the shift 
operators is equivalent to the decomposition of a A^^-dimensional two-q-nit state ket 
in the orthonormal Bell-state basis. This is at the heart of the quantum tomography 
techniques that we present in Sec. 14.21 below. 

The Bell states in p.l6|) refer explicitly to the computational basis because 
(|2.41|) expresses in terms of the \k © m){k\ = |e^„)(e^ | ket-bra products. We 
get the Bell states relative to the ith basis by applying the Clifford operator Ci of 
(|2.78p to the second q-nit and its dual analog C*, which we define by C*\e^*) = 
|e^*), to the first q-nit. In view of p.4|) and (|3.5|) . the analog of the correspondence 
(|3.13|) for the computational basis, is then 

(C* ^ Cmn..) ^ -y^C^VmCj , (3.19) 



and as a consequence of the trace rule p.3|) we have 



{Bm,n\{C: ^ C,)\B^,,,,) = ^tr{K^tc^yn;^t} . (3.2O) 

Upon employing p.70p to express C^V^C] in terms of the computational basis, 

Af-l 
N-1 

= Y.\n® 0«e(neO* ^^'^'"a'ezai > (3-21) 



the trace is readily evaluated, and we find 

\{C:<E>C,)\B 



©m0n i 



Qm 



— Sm,n' 5n,iQn'em' 7™ '^^ 'Ai' ■ (3.22) 

The two Kronecker delta symbols tell us that the application of the unitary operator 
C* (8) Cj to the Bell basis permutes the Bell states, but leaves the basis as a whole 
unaltered. 

Quite explicitly, we have 

\Bm.n) = (C* ® C,)|S,0™en,™)7"®"a^em ' 

(C; ® CJ|i?„,,„) = |i?„,.0„em)7'"®"«j. , (3.23) 
where the mappings of the indices, 

are each other's inverse. The particular case of m ^ n ~ 0, 

(C*®C,)|Bo,o) = |So,o), (3.25) 

states the invariance of the Bell seed when switching from one basis to another, 
which we have observed earlier in the context of p.lOp . 
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3.2. Quantum dense coding 

The generalization of q-bit quantum dense codin^^ to an arbitrary dimension N 
is an immediate application of p.l6p . It goes as follows Alice and Bob initially 
share the seed state |i?o o) of the Bell basis, with q-nit 1 in Alice's possession and 
q-nit 2 in Bob's. Bob applies one of the N"^ unitary shift operators V.^ to his q-nit 2 
and then sends it to Alice who, according to p.l6p . has the q-nit pair in the Bell 
state She finds out which of the states is the case by performing a von 

Neumann measurement in the Bell basis. 

The measurement result tells her which one of the N"^ shifts was implemented 
by Bob, and so she receives 2 log2 N bits of information, as much as two classical 
A'^-valued signals could convey. In a manner of speaking, Bob has transmitted two 
c-nits by sending one q-nit. This is the essence of dense coding; quite like the 
teleportation of the following section, it has no classical counterpart. 

Despite this "manner of speaking," quantum dense coding does not violate the 
Holevo bound^which states that a single q-nit can only transmit one c-nit, because 
of the earlier distribution of q-nit 1 to Alice that is entangled with Bob's q-nit 2 
from the beginning. At the time when Alice carries out the measurement that 
discriminates the Bell states, she has received both q-nits. 



3.3. Quantum teleportation 

The relation between maximal sets of orthogonal families of unitary matrices and 
teleportation was already emphasized several years ago.l^ Several generalizations 
of the teleportation scheme to arbitrary dimension that were proposed in the 
paspEHiail are close in spirit to the generalization that we proceed to describe 
now. 

A central ingredient of the q-nit teleportation process is the three-q-nit-states 
identity 

^ \k*,j,k} = ^ |B,„,„,fc)(B„^jr,j) 

k—0 k.in^n 

= E \Bm,n.k)tr{N-^/^v-^\j){k\) 

k,m,n 

= E \Bm,n,k){k\V-^\j) 

k,m,n 

^ m.n 

where the completeness of the Bell basis, the trace relation p.3|) . and the complete- 
ness of the computational basis are exploited. 

Now, to teleport an unknown state lip) = \j)ipj from q-nit 2 to q-nit 3, we 
prepare q-nits 1 and 3 in their Bell seed state, so that the initial three-q-nit state 



48 T. Durt, B.-G. Englert, I. Bengtsson, and K. Zyczkowski 



is 

J2 \k\j, k)^, = ^^(1^1® C^)|S„^„, V) . (3.27) 

A von Neumann measurement in tlie Bell basis for q-nits 1 and 2 will find one 
of the generalized Bell states, \B^ „) say, all N'^ outcomes being equally probable. 
Conditioned on the said measurement result, the state ket for q-nit 3 is then l/^^li/'), 
which is turned into jV') by performing the unitary transformation described by the 
shift operator V^. In effect, the unknown state has been teleported successfully 
and without any distortion from q-nit 2 to q-nit 3. If, at the time of the Bell 
measurement on q-nits 1 and 2, they are separated from q-nit 3 by a space- like 
distance, there exists no classical counterpart for this quantum teleportation. 



3.4. Quantum cryptography, covariant cloning machines, and 
error operators 

In quantum cryptography, MUB play an important role because they maximize 
uncertainty relations which ensures the confidentiality of protocols for quantum 
key distribution,'Sl[l2l[loHl2l although MUB are not really needed in arbitrary di- 
mensions.!^ For instance, the celebrated BB84 protocol^ consists of encrypting 
the message in a q-bit state that is chosen at random between four states that 
belong to two MUB. The relevance of MUB for quantum cloning has also been rec- 
ognized,l^'S^Hlll which is not unexpected in view of the close link between cloning 
and the security of key distribution protocols: as a rule, the most dangerous eaves- 
dropping attacks can be realized with the aid of optimized one-to-two doners — 
the so-called phase-covariant cloner,'^^!^ for instance, when attacking the BB84 
protocol. 

The symmetry properties of the Bell states have important implications in the 
theory of cloning machines,'^'^ as we shall sketch briefly now. Under very general 
conditions,!^ optimal cloning states obey Cerf's ansatz,'S2HIIl 

JV-l 
m,n— 

= J2 (l0C®l®C^)|So,o,So,o)a™,n, (3.28) 

m,n— 

which is a four-q-nit state that is constructed as a linear superposition of states 
that have q-nits and 1 in the m, n Bell state and q-nits 2 and 3 in the Qm, Qn 
Bell state. Except for the normalization constraint, 

JV-l 

(*o-3|*o-3)= h™,"!'^!' (3-29) 

■m,n— 

the probability amplitudes am,,n are arbitrary, their values specify the particular 
cloning state. In one standard scenario (see below), q-nit will be measured and 
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thus projected onto one of a set of chosen states, q-nits 1 and 3 will be the clones, 
and q-nit 2 the anticlone (or "machine"). 

The expansion of the state ket (I3.28P in the biorthogonal double-Bell basis, with 
only N"^ of the N'^ basis states appearing in (I3.28p . emphasizes a generic property 
of such cloning states, namely their covariance when passing from one of the MUB 
to another. This covariance property, which we discussed at the end of Sec. I3.1[ 
is of considerable importance in various contexts, such as cryptography protocols 
that treat all single-q-nit MUB on the same footin^^l^EnillQl a^fj phase-covariant 
cloning ,1^3^211 and also has a bearing on the Mean King's problem of Sec. 14.11 

In the present context, we need yet another symmetry property, namely that 
the two clones — q-nits 1 and 3 — play complementary roles. To establish this 
point, we first recall the definition of the generalized Bell states in p.l3|) and note 
that 



\B^:^lBtllen) = ^ E |fc*,fc®m,r,?e™)7('=®'"^='"7^('^'")°", (3.30) 

where we now employ a notation that indicates which q-nits are paired in the Bell 
states: with 1, and 2 with 3, as it is the case in (|3.28p . Alternatively, we can pair 
with 3 and 2 with 1, which gives 

N-l 

\B^n,Bf2.,en) = ^ E |fc*,^em,r,fc®m)7('=®™)°"7®('e'")®". (3.31) 

In fact, the states of p.30|) span the same A^^.^i^^gnsional subspace as the states 
of p.3ip in the TV'-dimensional four-q-nit Hilbert space. 

To justify this remark, we evaluate the transition amplitudes, 

/o(03) „(21) |n(oi) „(23) . 
N-l 

_ ^ ST^ (fc©m)0ne(ie™)0ne(fe ©m')©n e(i em )0n' 

k,k',l,l'=0 

X {k'*,l' e to', l'*,k' ®m'\k*,k® to, 1*, I Q to) 
1 '^"^ , ,,,,,, 

k,k',lA'=0 

X Sk\kSk' ®m' ,lQmSl\l5l' Qm' ,k®m , (3.32) 

where this product of four Kronecker delta symbols equals Sk,k'Si,i'Sm®m' ,iQk, a 
product of only three, with the consequence that 

/o(03) „(21) |„(01) n(23) \ J_ (mem')0(«©n') /o oo^ 

\-°m',n''-°©m',en'l "I,"' ©"i,en/ ~ ' ' \0.00) 

For given \Bm,nT Bqjj^ qj^) these are transition amplitudes, each of modulus 
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N, and therefore no other 5(^3)^(21) j^g^g appear on the right-hand side of 

N-l 

|n(01) o(23) X J_ |n(03) n(21) \ (mem')0(n®«') 

l^m,ru ^eni.en/ — ^ 2^ \^m' ,n' > -^Qm' ,en' /I ■ {O.O'i) 

m'.n'— 

It follows that (5^?L"-B^'V„"l^m,",-B^^^^e„) = unless both to' © to" = and 
n' © n" = 0, which can be verified directly. In particular, we have 

1 

|So,o,So,o) = l<o^<o^) = ]^ ^ (3.35) 

m,n— 

which we use in p.28p to arrive at the alternative expansion 

1*0-3) = 5] (1 ® ® 1 ® Ol<o\ <o^)&™,« , (3-36) 

m,n— 

where the probabihty amphtudes bm,n are the double Galois-Fourier transforms of 

the Clrn^n^j 

= ^ E 7"®" . (3.37) 

m' ,n'— 

The stage is now set for a discussion of cloning. We consider two standard 
scenarios. In the first scenario, Alice and Bob believe that they share the Bell state 
described by ket |i?Q°Q''), but in fact eavesdropper Eve controls the two~q-nit source 

and has replaced ISq^q') by |\l/o-3). Alice measures her q-nit and finds it in the 
state described by the bra {ip* \ , so that the state of Bob's q-nit 1 would be described 
by ket lip), but the ket for the resulting state of q-nits 1-3 is actually given by 

1*1-3)- E (C®l®C^)IV',S^'o^)«™,n 
m,n— 

= E (C^®l®OI<o\^>&™,"- (3.38) 

m,n— 

The resulting statistical operator for Bob's q-nit 1, the first clone, is 

N-l 

Pi = tr2&3{|*l-3)(*l-3|} = E IV'>n,«)|am,«| (V'm,n| (3.39) 

m.n—Q 

with \tpm,n) — KnlV')j ^nd for q-nit 3, the second clone, we obtain 

P3 =tri&2{|*l-3)(*l-3l} = E IV'm,«)|fem,n|^(^m,n|- (3-40) 

m,n— 

The displacement operators appear as error operators in p.39p and p.40p . 

There are two extreme complementary situations: If a„i „ — Sm.o^n.o thus 
|^m,n|^ — then pi = is the projector on the target state \ip) and 



On mutually unbiased bases 51 



= l/N is the completely mixed state, as implied by the ergodicity relation (I2.48P : 
but if bm,n = Sm.oSn.o and thus |a„i_„|^ = f/N^, we get pi = 1/N and ps = 
In intermediate situations, both pi and p^ are imperfect copies of 

We see that, as a consequence of the Galois-Fourier relation (|3.37p . the two 
clones are complementary to each other in the sense that if one of them projects 
on the target state \tjj), then the other is completely mixed. More generally, if one 
clone is in a pure state (not necessarily the target state), then the other clone is in 
the completely mixed state. 

This complementarity is important because it helps us to understand the main 
idea underlying quantum cryptography: If the first clone is received by Bob, to 
whom it appears as the target state with an admixture of noise, and the second 
clone is Eve's imperfect copy (she also has access to the anticlone), then the more 
Eve knows about Alice's or Bob's signals, the less strongly their signals are cor- 
related. In other words, when the entanglement between two of the three parties 
becomes stronger, the entanglement with the third party weakens, an idea that was 
already central to the first entanglement-based protocol, the 1991 Ekert protocol.'^ 
For obvious reasons, this property is sometimes referred to as the "monogamy of 
quantum entanglement." 

The second scenario is that of BB84-typ^Sol g^i^emes for quantum cryptography: 
Alice prepares q-nit 1 in the state described by ket jV') and sends it to Bob. Eve 
gets hold of the q-nit in transmission, combines it with her q-nits 2 and 3 that she 
had earlier prepared in the '00' Bell state, and realizes a unitary transformation 
that effects 



N-l 
m,n— 



N-l 

= Yl |fc®m,B(3'^^,en)7'°"a™.« (3.41) 

m,n— 

for all kcts \k) of q-nit 1, so that B^q^) is turned into the kct of ()3.38|) . 

|V',<o'^)^ 1*1-3). (3.42) 

Then q-nit 1, the first clone, is forwarded to Bob and Eve keeps the second clone 
and the anticlone. 

The unitary property of the map p.41[) is confirmed by 

N-l N-l 

= Sk,k' ■ (3.43) 

Accordingly, Eve can — in principle, at least, if not in practice — implement (|3.4ip 
by a suitable interaction between q-nits 1 and 3. 
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We further note that the Heisenberg-Weyl group is not only related to the error 
operators that describe the imperfections of the clones, it is also directly related 
to error correcting codesl^^HlI] instance, the Shor code for q-bits (see, e.g., 
Ref. |64|) exploits the fact that the Pauli a operators are an operator basis in the 
q-bit space. Higher-dimensional generalizations of this code likewise exploit that 
the Heisenberg-Weyl operators, essentially the shift operators of (|2.4ip . constitute 
an operator basis, especially in the many-q-bit case {N — 2^'). 

3.5. Entanglement swapping 

A system of four q-nits, prepared in the state described by one of the kets 
\Bmln, Q^) of (|3.34p . has the q-nit pairs (01) and (23) in maximally entangled 
states while there is no entanglement between the two pairs. If one then performs 
a Bell basis measurement on the pair (12) and finds it in the Bell state \BqJ^, q„/), 
the state of the pair (03) is reduced to the Bell state \B^P^,). In a manner of speak- 
ing, half of the original entanglement between the pairs (01) and (23) is used up in 
the Bell measurement on the pair (12) and the other half is transferred to the pair 
(03) which emerges maximally entangled. 

At the time when the pair (12) is measured, q-nits and 3 can be far away, 
possibly at space-like separations from each other and from pair (12), and q-nits 
and 3 may never have been close to each other in the past. What matters is that 
their partners, q-nits 1 and 2, with which they share the maximally entangled initial 
Bell states, are brought into contact during the Bell-basis measurement on the pair 
(12). As soon as the outcome of the measurement on pair (12) is communicated 
(through a classical channel) to the experimenters in possession of q-nits and 3, 
they can exploit the entanglement in the resulting Bell state 

This entanglement swapping^^ has been demonstrated for q-bits carried by pho- 
tons in different experiments; see Refs. I67II68[ for example. In conjunction with 
quantum repeaters, entanglement swapping offers a practical way of creating strong 
entanglement between q-nits that are far apart.^ 

4. The Mean King's problem and quantum state tomography 

4.1. The Mean King's problem in prime power dimensions 

The "Mean King's Problem" originated in the 1987 paper by Vaidman, Aharonov, 
and Albert,!^ which deals with the N = 2 case. Generalizations first to iV = 3,1^ 
then to N prime,!^ and finally to prime-power values of N^^^^ were completed 
some 15 years later. For further generalizations see Refs . [74l and [75l In the simplest 
case {N = 2), the problem can be presented as in Ref. ID 

The Mean King challenges a physicist, Alice, who got stranded on the 
remote island ruled by the king, to prepare a spin-^ atom in any state of 
her choosing and to perform a control measurement of her liking. Between 
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her preparation and her measurement, the king's men determine the value 
of either Uy, or (t^. Only after she completed the control measurement, 
the physicist is told which spin component has been measured, and she 
must then state the result of that intermediate measurement correctly. 

In dimension N, where TV is a prime power, the challenge can be summarized in 
this way: Alice prepares a q-nit system in any state of her choosing and performs a 
control measurement of her liking. Between her preparation and her measurement, 
the king's men measure the q-nit in one of the N + 1 MUB. The particular basis 
chosen for the intermediate measurement is communicated to Alice only after she 
has completed the control measurement, and she must then state the result of that 
intermediate measurement correctly. 

The power of entanglement enables Alice to rise to this challenge. Her solution 
consists of four stages: 

(i) She prepares q-nit 1, which will be handed to the king's men, jointly with 
q-nit 0, which she will keep for herself, in the Bell state |i?o,o) of p.lO|) . 

(ii) The king's men measure q-nit 1 in the ith basis of the MUB and find it in the 
fcth state, whereafter the state ket of the q-nit pair is |e^*, e^); there is a total 
of N{N + 1) states of this kind. 

(iii) Alice measures the q-nit pair in the entangled basis composed of the N'^ pairwise 
orthogonal states |(m,n)) that are given by 



|(m,n)) = (C*^ 01(0,0)) form,n = 0,l,...,iV-l 
1 ^ 

with the "seed" |(0,0)) = |e^*,e^) - |Bo,o) ■ (4.1) 



N 

N ^ 

Alice's measurement outcome is an ordered pair of field elements (m, n). 
(iv) Now, being told that the ith basis was measured at the intermediate stage (ii) , 
and having her outcome (m, n) of the control measurement of stage (iii) at 
hand, Alice correctly infers that the king's men found q-nit 1 in state |e^) with 

^^(iQmeniort = 0,l,...,N-l, 
\ m for i = N . 

As shown in Ref. [731 this solution is a special case of Aravind's very general 
solution,!^ which is formulated without a particular choice for the maximal set of 
MUB; our solution exploits the specific MUB of Sees. [^ETil For = 2, 3, 4, 
and 5, all maximal sets of MUB are equivalent in the sense that they can be 
turned into each other by unitary transformations combined with permutations of 
the basis kets; more about this in Sec. [5l A finer notion of equivalence, which takes 
entanglement properties into account, is possible in composite dimensions. In this 
finer sense there are inequivalent MUB for 8 and N = iqMSTMM 
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The explanation how Ahce's scheme works begins with first noting the exphcit 
form of the two-q-nit states |(m, n)) of Ahce's measurement basis, 




iQmQn^ iQmQn/ 



- \Bo,o) , (4.3) 



where the sum over i does not include the computational basis (i — N), as it does 
for the seed in (I4.ip . With the aid of (|2.52p . the invariance property p.l7p . and 
{el*,el\Bo,Q) = 7V-i/^ we then establish 

(Bo,o|(™,n)) = ^ (4.4) 

and 

,„ (h,tQmen/y/N for i = 0, 1, • • • , - 1 , ,^ , 

from which follows the orthonormality 

{{m,n)\{m',n')) = 5m,m' 5n,n' , (4.6) 

thus confirming that the kets |(r7i,n)) constitute an orthonormal basis in the iV^- 
dimensional space of two-q-nit kets. 

Now, after the king's men find q-nit 1 in the fcth state of the ith basis, the q-nit 
pair is in the state described by the bra {e" , . Clearly then, the Kronecker delta 
symbols in (|4.5|) enable Alice to infer the k value in accordance with ()4.2p . For, 
only a single k value is possible for the actual outcome {m,n) of Alice's control 
measurement and the zth basis chosen by the king's men. 

It is important that Alice can always infer the correct k value with certainty. 
This aspect can be understood, or illustrated, by a geometrical picture, in the sense 
of affine geometry (more about this in Sec. 14. 3p . When the king's men find the fcth 
state of the ith basis (where i runs from to N, and k from to — 1) A of the 
N"^ detectors fire with equal probability in Alice's control measurement, namely the 
detectors whose (m, n) values appear in 

JV-l 



\{m,iQmQ k)) for i = 0, 1, . . . , A^ - 1 , 

(4.7) 



^V|(/c,n)) iori = N. 

^ n—O 



Accordingly, in the N x N discrete plane (grid) spanned by the pairs (m, n) the 
labels of these detectors are on the straight lines mi-^n = iQmQk with slope i 
when i = 0, 1,...,A'^— 1, and on the "vertical" lines m — k when i — N. Figure [1] 
shows the five grids for A — 4 as they result from the multiplication and addition 
tables in Table [ll^ a). 

In Aravind's construction,^^ the combinatorial properties offered by an affine 
plane of order N (properly defined in Sec. 14.31 below) are a crucial ingredient. This 
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Fig. 1. The Mean King's Problem for N = 4. The five 4x4 grids show the k values for i = 0, . . . , 4 
clocltwise, with j = at the top. In each (m, n) grid, the columns are labeled by m from left to right, 
and the rows are labeled by n from bottom to top. For example, we have k = 2 for (m, n) = (2, 1) 
in the grid for i = 2. 

is also true in this geometrical picture: Because the addition and multiplication 
form a field, exactly one straight line of given slope passes through each point 
of the grid, which is a sine qua non condition for unambiguously inferring which 
detector fired during the king's men's measurement. 

In Alice's measurement bases ()4.3p . the N{N + 1) two-q-nit states |e", el.) are 
grouped into N'^ sets of + 1 states, each state appearing in N sets, and each set 
composed of one state from each of the iV + 1 MUB. The states of the set associated 
with a measurement outcome (to, n) correspond to the respective N + 1 grid points; 
such as the highlighted grid points for {m,n) = (2,1) in Fig. [TJ 

The normalized superposition states of the iV^ sets that appear in (|4.3p , 

Af-l 




E 



iQraQn^ ^iQmQnl 




N 

|(m,n)) + 



2N + 2 



(4.8) 

are linearly independent, but they are not pairwise orthogonal. Rather they are 
the edges of an acute TV^-dimensional pyramid, with angle arccos 2N+2 between 
each pair of edges, and the invariant Bell state |i?o,o) as the symmetry axis of the 
pyramid. Alice's measurement is the so-called "square-root measurement" for this 
pyramid, the natural von Neumann measurement associated with the pyramid.'^'^ 



4.2. State tomography with discrete Weyl and Wigner phase-space 
functions 

Owing to the correspondence p.2p . the expansion of any operator in a one-q-nit 
operator basis, which is at the heart of quantum tomography, is related to the 
expansion of a two-q-nit state ket in the corresponding ket basis. In the general 
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situation, we have a positive-operator-vahied measure (POVMjl for the two-q-nit 
states, 

= (4-9) 



k 

t2 



a sum of N or more hermitian, rank-1, two-q-nit operators. In accordance with 
the mapping of (|3.2p - (l3.5l) . there is a single-q-nit operator Ak for each ket |afe), 

\ak) ^ Ak , (4.10) 

and, in view of the trace rule p.3|) . the expansion 

\x) =Y,\au){ak\x) (4.11) 

k 

of a generic ket |a:) then imphes the corresponding expansion for the operator X 
associated with jx), 

|a;)^X = ^A,tr{4x}, (4.12) 

fc 

which is vahd for any single-q-nit operator X. This identity is the completeness 
relation for the operator basis composed of the AkS. 

In the more particular case of an orthonormal basis of N"^ kets (and its adjoint 
basis of bras), {aj\ak) = Sj^k, the POVM in (|4.9|) refers to an ideal von Neumann 
measurement, and we have the corresponding orthonormality statement for the 
operator basis: trjAjylj,} = 6j^k- This is the situation for the two specific two-q-nit 
bases that we encountered in Sees. 13.11 and 14.11 respectively: the basis made up 
by the generalized Bell states |i?m,n) of p.l3|) . and the basis composed of Alice's 
"mean king states" \{m,n)) of (|4.3|) . The operator basis corresponding to the ket 
basis of Bell states is the Galois field version of Weyl's unitary operator basiJ^I^ of 
Sec. 11.11 and the operator basis associated with the ket basis of mean-king states 
is a candidate for a discrete analog of the familiar hermitian Wigner basis for a 
continuous degree of freedom.'^'^ 



4.2.1. Discrete Weyl-type unitary operator basis and phase-space function 

When we identify the Bell kets |i?m,n) with the basis kets \ak) in (j4.10l) . the mapping 
(|3.13|) teUs us that N'^^^^V^ corresponds to Ak, and the completeness relation 
(|4.12|) acquires the form 

^ ^""^^ ^'^^ C=tr{Ct^}. (4.13) 

m,n— 



°POVM, with its emphasis on "measure" and the connotations of measure theory, is mathematical 
terminology. The corresponding quantum-physics term POM (probability operator measurement) 
refers to the physical significance. 
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The unitary shift operators compose the operator basis, and the coefficients 
make up the discrete phase-space function (m, n) i— > of Weyl-type. The mapping 
of the operator X to its Weyl-type phase-space function is one-to-one: There is a 
unique single-q-nit operator X to the given set of coefficients {x^}^ ^^^g, and all 
ccJJjS are uniquely specified by the given operator X . In particular, we have 

xl=tT{X]. (4.14) 



Since the unitary operators Ul of the abelian subgroups of Sec. 12.41 comprise all 
the shift operators with the identity 1 = V§ = 11^ appearing N + 1 times, once 
for each subgroup (i = 0, 1, . . . , iV), an alternative way of presenting (14.13^ is 

N N-1 

X = -tr{X} + -^^C/^xj with x\^iT{ufx]. (4.15) 

j=0 1=1 

The coefficients in (|4.13p and (|4.15l) are related to each other by 



" x\®^ fori = 0,l,...,iV-l, 
xi ioT i — N , 



(4.16) 



which is an immediate consequence of (I2.50p and (|2.54l) . The two expansions (|4.13l) 
and (I4.15P are really the same expansion twice, differing solely by the labeling of 
the terms. 

Weyl tomography, on many identically prepared q-nits with statistical opera- 
tor p, amounts to measuring equal fractions of the q-nits in the -I- 1 MUB of 
Sees. I2.2H2.4I The measurements provide the probabilities (eyp|e^)lp| from which 
the expansion coefficients 

fl = tT{ufp} = J2 7®'®'(el|p|eD (4.17) 

k=0 

can then be computed, as follows from (|2.5ip . With X ^ p, tr{X} — > 1, — f; 
in (|4.16|) . the statistical operator p is parameterized in terms of the unitary Weyl 
basis Ul and the measured coefficients fj. 

There are N measurement outcomes for each of the -f 1 MUB, so that one 
is measuring a total of N{N + 1) probabilities (or relative frequencies) in order to 
determine the N'^ — 1 parameters of the statistical operator. Clearly, there is some 
redundancy in the data, namely that Tq — 1 for all iV -f 1 values of i. Nevertheless, 
the measurement of the A^-|-l MUB realizes state tomography that is optimal in the 
sense of Ref. 155] Other choices of A^ + l von Neumann measurements, not composed 
of bases that are pairwise MU, give estimates for the statistical operator with 
larger statistical errors when measuring finite samples, as is always the situation in 
practice. 



PThis is an idealization of the real physical situation. Any actual experiment will give the rela- 
tive frequencies from which the probabilities can be estimated. The subtleties of quantum state 
estimation are the subject matter of Ref. 1841 
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Yet, when we regard the measurements of the iV + 1 bases, on equal fractions 
of the q-nits, as jointly defining a POVM with N{N + 1) outcomes, then these 
are more outcomes than are really needed to determine N'^ — 1 parameters. More 
economical, and thus optimal in a different sense, are POVMs with the minimal 
number of N'^ outcomes (the one constraint of unit total probability is always there) . 
And among those, a particularly good choice is the "symmetric informationally 
complete" (SIC) POVM.I^ This is a different story, however, which does not need 
the structure of an underlying Galois field, a ring structure suffices; see Refs. [87] 
and [18] for further information. The recent comprehensive account by Scott and 
GrassP^ is recommended reading. 

4.2.2. The limit N oo of continuous degrees of freedom 

At the end of Sec. 12.31 — recall (|2.32|) and ()2.33p — we observed that the unitary 
shift operators V^l = V^V^ are products of M factors, one for each constituent 
q-pitO 

M-l M— 1 

where the mjS are the p-ary coefficients of m as in (|2.1|) . and the n^s are the 
conjugate coefficients of n in the sense of (|2.35|) . There are unitary shift operators 
V~^^^A for each j value, and those referring to different j values commute with each 
other. Accordingly, the factorization (|4.18p is a decomposition of into the Weyl 
operator bases of the individual M q-pits that make up the q-nit. 

It is, therefore, systematic to regard the q-nit as a system of M q-pit degrees of 
freedom, rather than a single q-nit degree of freedom. The limit N od is then 
understood as p — > oo for the given value of M, so that we obtain M continuous 
degrees of freedom or, put differently, a M-dimensional continuous system. 

In view of the factorization observed above, the limit p — )■ oo is carried out for 
each of the M q-pits individually. The details, and the subtleties, of this p — ^ oo 
limit are discussed in Sec. 11.1.71 

4.2.3. Discrete Wigner-type hermitian operator basis and phase-space 
function 

When we identify the two-q-nit kets \{m,n)) of Alice's mean-king basis in (|4.3p 
with the basis kets \ak) of (|4.9p . the corresponding single-q-nit operator basis is 

'^As in H2.35|l . read the product n^Qj as the number multiplying the row of p-ary coefficients 
for Qj , so that the outcome is the field element Q Qj- A similar remark applies to the product 
rrijp^ , except that in this case there is no difference between the number product of mj and 
and the field product. 
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composed of the operators Wm,n that we get from the correspondence ()3.2p P^ 



N-l 



|(m,n))ViV o T4-,„,„ - \eZ){eZ\ + E \<Qrnen) {<emen\ "1, (4-19) 

i=0 



with a conventional removal of the factor l/y/N from the definition of the Wm,nS. 
These operators are hermitian, normalized to unit trace, and pairwise orthogonal, 

Wl.n^W^^^, tr{W^,„_„} = l, tr{iy„^„W^,„,,„,}=7V<5„,™,<5„,„,, (4.20) 

and their completeness relation is stated by 

E ryn,nWyn,n with r„,„ = tr {pH/™^„ } (4-21) 

■m,n— 

for the statistical operator p, but is equally valid for any single-q-nit operator X. 
The coefficients rm,n are the discrete analog of the familiar Wigner phase-space 
function for a continuous degree of freedom. 

Wigner functions for finite-dimensional systems have been defined in several 
different ways.^^"^^ Here we choose to follow Wootters and his collaborators,'^2H2l! 
who regard an operator basis as an acceptable discrete analog of the continuous 
basis underlying Wigner's phase space functiorlS^lIHll if meets five criteria: 

(Wl) each basis operator is hermitian; 

(W2) each basis operator has unit trace; 

(W3) the basis operators are pairwise orthogonal; 

(W4) the basis as a whole, that is: the set of N"^ basis operators, 

is invariant under the unitary tranformations of the iV^ , , 

Weyl operators; 

(W5) the marginals of the operator basis are rank-1 projectors, 
whereby the N projectors associated with parallel lines are 
mutually orthogonal and thus compose a basis for the kets 
and bras, with MUB for different sets of parallel lines. 

The notions of "marginals" and "parallel lines" will be explained shortly. To the 
five criteria of (|4.22p we add a sixth criterion: 

(W6) in the limit — > oo the sequence of discrete bases con- , , 

verges to the standard continuous Wigner basis. 

It seems to us that (W6) is necessary to justify the term "discrete Wigner-type 
basis." 

Criteria (W1)-(W3) are the three statements in (|4.20p . and criterion (W4) is 
an immediate consequence of (I2.7ip , that is: 

W™,„ = C W^o,o V-J = Vllt, Wm',n' Vllt' (4.24) 

for all m,n and all m',n'. Just like |(0, 0)) is the seed for the ket basis (|4.ip . Wq.o 
is the seed of the operator basis (|4.19p . 
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Regarding criterion (W5), we first note that a marginal operator, or simply: 
marginal, of the basis is the equal- weight average of all basis operators on an affine 
straight line. We specify a particular straight line by requiring that all m, n values 
on the line obey a(Dm = bQn(Bc where a, b, c is any given trio of field elements, 
excluding solely the choice of a = 6 = 0. Clearly, the trio a Q d,b Q d,c Q d with 
d specifies the same line, and the lines for ai, &i, ci and 02,^2, C2 are parallel if 
oi 62 = 02 61, whereas they intersect in one m, n point if ai 62 7^ 02 ^i- 

Accordingly, the marginal operators are 

^m7^=o \\e^0a){e^0a\ if 6 = 0anda^0, 

(4.25) 

and the case a = 6 = 0, for which Afo,o.c = Sc,o'^, illustrates an ergodic property of 
the Wigner basis, 

1 JV-i 

^ E Wm,n = l. (4.26) 

m,n— 

Another way of stating the explicit projector values of the marginals is 



d(4\ 



-y 

N ^ 

m=0 



Mi^i^k = ^ y Wm,iQmek for i = 0, 1,2, . . ., A^- 1 , 



Mi,o,fc = T7 XI ^i'-" ^^'^ i = N, 



(4.27) 



N 

n=0 



which we recognize as the single-q-nit operator version of the two~q-nit identities 
in ()4.7p . Indeed, the projectors for the A^ parallel lines with slope a 6 = i make 
up the ith basis for i = 0, 1, . . . , Af — 1, while the computational basis (« — N) is 
obtained for the "vertical" lines with b = 0. These are, of course, the sets of parallel 
lines that we encountered in Sec. 14.11 as illustrated in Fig. [T] One could say that 
the relations (|4.19p and (|4.25p are reciprocals of each other: The projectors |e^)(ey 
are marginals of the basis operators Wm,n, and the Wm,nS are marginals of the 
projectors (up to a subtraction of the identity operator). 

The reciprocity of the relations ()4.19p and (|4.25p is even more striking if, follow- 
ing the geometrical approach emphasized in Sec. II. 2) we define the vectors of 
that are naturally associated with the Wigner operators Wm,n and the projectors 

^m,n = >Vm,„ - ^ Wrn,n - P* , 

p^ = ^^vf -^'* = I4)(4I-P*, (4.28) 

where the matrix Wm,n represents Wm,n, and ipl is the column for |e^). It clearly 
results from the ergodicity condition (14.26^ that the w„i^„s obey 

JV-l 

X w™,„ = 0. (4.29) 
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The Wm.nS are thus the vertices of a regular simplex in and this is how we 

want to think about them now. We refer to the Wm.„s as the face points. 
Equations (|4J9l) and (|4:27| now appear as 



N-l 

N , 



and 



i=0 



1 



Yl P^omen > (4-30) 



Pfc = Mi,i^k = ^ X! ^ni,iQmek for i = 0, 1, 2, . . . , iV - 1 , 

1 

pf =-MiAfc = ]^E^fc^"' (4.31) 

n=0 

where matrix A^a,6.c represents Ma^b.c of (|4.25|) . 

There is a natural interpretation of (|4.31l) in It says that the vertices 

of the MUB polytope lie at the centers of certain specially selected faces of the 
face point operator simplex. The former has been inscribed into the latter in a 
special way. Alternatively, (|4.30p says that the vertices of this simplex lie right 
above the centers of certain special faces of the MUB polytope. These faces are 
orthocomplemented to the facets (the highest dimensional faces). To see this, note 
that tr{ W,„^„Af} = constant defines a hyperplane in R^ the space of vectors 
m that (jl.82p associates with the unit-trace hermitian matrices M . All the vertices 
of the MUB polytope lie either in the hyperplane tr{lFm^„M} = 0, where they span 
a facet, or in the hyperplane tr{Wm,Tt-M} = 1, which is the orthocomplemented 
face. All points in the polytope obey < iv{Wm,nM^ < 1, for all values of m and 
n. This underlies the construction of Wootters's analogs of Wigner's function, and 
it explains why we refer to the vectors w,„_„ as face points, and to their unit trace 
versions Wm,n as face point operators. 

In passing we note that one can prove a remarkable result in prime dimensions!^ 
All statistical operators such that < tr{Wm„p}, which says that their Wigner 
coefficients are positive, necessarily are convex combinations of projectors onto the 
states \e\) of the MUB, for which 

/ Mw in /4en,i0m fori = 0,1,..., iV-ll 

{ek\Wm,n\ek) = { ^ r . ^=Oorl. (4.32) 

[ 4,m for i^N J 

In other words, the statistical operators |e^)(ey belong to the polytope. So, the 
equation < tr {Wm,„M} < 1 is necessary and sufficient for belonging to the 
MUB polytope. We conjecture that this is also true in prime power dimensions. 

With criteria (W1)-(W5) taken care of, we finally turn to (W6). As noted in 
Sec. 14.2.21 the limit = p^' — oo is the limit p — )■ oo with a fixed value of M, so 
that we are consistently dealing with a system composed of M q-pits and arrive at 
a M-dimensional continuous system in the limit. Contact with the standard Wigner 



62 T. Durt, B.-G. Englert, I. Bengtsson, and K. Zyczkowski 



basis is, therefore, established if we gei|f| 

Wo,o^ Jd^'x\~x)2"{x\^P(E)P^---(E)P (4.33) 
in the hmit, that is: M copies of the one-dimensional parity operator 

oo 

P= J dx\-x)2{x\, (4.34) 

— oo 

the seed of the Wigner basis,'^'2Zl-^y];iere the factor of 2 ensures proper normalization 
to unit trace, tr{P} — 1. 

Now, after expressing the projectors in 

N 

W^o,o = El^o)(e?,|-l (4.35) 

i=0 

in terms of the unitary shift operators, we have 

N-l / N^-l \ 

^0^0 = ^ E + E -T'yi ' (4-36) 

z=0 \ j=l J 

where p. 541) and the k = version of (|2.68l) are the main ingredients. This shows 
that the seed Wofi — and, therefore, also all other Wm,nS — is an equal-weight 
sum of all iV^ operators of the unitary Weyl basis, whereby the phase factors a^!^-' 
ensure that Wo,o is hermitian. 

This is illustrated by the N = 2 example for which 

^0,0 = 7:i'^ + + (Jy + (Jz) , Wo,i = i(l - cr^r - 0-y + (T^) , 

I { (4.37) 

Wlfi = -(1 + (Tj. - CTy - Cr^) , Wl^l ^ -{1 - (T^ + (Ty - (T^) , 

are well-known q-bit analogs of the Wigner basis operators. In an ill-fated attempt, 
Feynman used the expectation values of these operators to introduce probabilities 
of "(Ta; ~ 1 and (Tz = 1" and the like. But since the eigenvalues of the four operators 
in (|4.37l) are ^(1 ± -y/S), he was forced to resort to the dubious notion of "negative 
probabilities" which, in fact, gave this paper its title.ESl A direct measurement of 
the said expectation values, for the polarization q-bit of a photon, is reported in 
Ref.lMl 

In the limit p — > c», only odd values of p are relevant, and for those 
i = (i 2)©(j 2) is true, which allows us to write 

Vi = j^^^'^X^,V^V^^, (4.38) 

'The integration in I I4.33I I is over the M-dimensional real space, x = (xo,xi, . . . ,Xm— i) with each 
coefficient Xj taking on all real values. 
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with the aid of (|2.43p and, if we choose the symmetric value of (|2.58p for a\, we 
have 

af'^'"^'^^ = 1 (4.39) 

for the product of phase factors, that is: ij we enforce the symmetry property (|2.66p . 
With this symmetry in place, then, the seed is (j — > 2 k) 

N-l N-l 

^0.0 =nT. ^'^^"^^ = E ^'c"|0)(0|y,° 

N-l N-1 

= ^|fc)(efc|=^|e^,)(e»e/ch (4-40) 

fc=0 k=0 

where the value of the last summation does not depend on the basis label i. This 
is clearly the discrete analog of the continuous M-dimensional parity operator P in 

N~l p-1 p-1 

fe=0 feo=0 fci=0 

the product of M factors of the analog of the one-dimensional parity operator in 
()4.34|) . And since the unitary shift operators factorize in accordance with ()4.18p . 
this factorization of the Wigner seed carries over to all operators of the Wigner 
basis in virtue of property (W4). The limit p — > oo, then, gives us the right-hand 
side of ([433]) as desiredQ 

In summary, the basis composed of the operators Wm,n as defined in (|4.19p 
obeys criteria (W1)-(W5) by construction, and also criterion (W6) if the symmetry 
property (j2.66|) is imposed on the phase factors a\ of ()2.54p . We then have a genuine 
analog of the standard Wigner basis for continuous degrees of freedom, and it is 
fair terminology to call the Wm.nS the elements of the iV-dimcnsional Wigner basis, 
as we have already been doing above. 

It is worth remembering, however, that all permissible choices for the a\ give a 
good hermitian operator basis for which (W1)-(W5) are true, and the limit p — ?> oo 
is of little concern for any particular value of N = p^' at hand. If one makes use of 
the option discussed in the paragraph after (j2.57l) and multiplies the right-hand side 
of (|2.58p by 'y''*©' with 6o = and arbitrary field elements bi for i = 1, 2, . . . , — 1, 
then 

N-l 

<^ - ^ E I'^^'^'^'vy^V^ (4.42) 

"This limit has its subtleties (see the references cited in Sec. ll.l.Tt and requires careful attention 
to the factor of 2" in 114.2711 which, roughly speaking, originates in 

tr{| e k)(k\} = 52Qk,o = Sk,o ^ S{x) = 2"5{2x) = tr{| - x)2"{x\} . 
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replaces the 6^ = version of (|4.40p . If one or more of the biS are nonzero, Wq ^ 
is different from all Wm,nS and, therefore, the hermitian operator basis generated 
from the seed Wq''^ is different from the Wigner basis — the parity operator (|4.4ip 

is not one of the basis operators. There are in total A^^^^ different seeds W^f^ and 
as many hermitian operator bases and with suitable — > oo limits for the biS the 
seeds will have well-defined limits themselves, but in our understanding only the 
6 = basis is a true finite-dimensional analog of the Wigner basisQ 

We thus observe that the symmetric choice of p.58|) is the right choice for 
obtaining a proper analog of the Wigner basis. It also endows the Wigner basis 
with certain elegant covariance propertieP^ that will be discussed in Sec. 14.2.41 

We further note that the property (W5) is sufHcient to derive that each Wigner 
operator is equal to the sum of projectors onto states from different bases minus the 
identity operator as expressed by (|4.19|) ; the explicit choice of MUB that we made 
in Sec. [2] is not crucial. Indeed, the sum of all the Wigner operators that belong to 
the -|- 1 (nonparallel) straight lines passing through a phase space point (m, n) is 
also equal to the sum of all Wigner operators plus N times Wm.n', as a consequence 
of (W5) it also equals N times a sum of the projectors onto states from different 
bases; now, the sum of all Wigner operators equals N times the identity as noted 
in (|4.26p . It follows that each Wigner operator plus the identity operator is equal 
to a sum of projectors onto states from different bases. 

This is how Wootters et al. derived an expression for (loosely analogous) Wigner 
operators similar to (|4.19p .^'^ which may or may not possess property (W6). Their 
approach is somewhat more general than ours in the sense that theirs is valid 
whichever set of iV -I- 1 MUB is adopted, whereas the expression (|4.19l) refers ex- 
plicitly to the bases defined in (|2.70p and specified unambiguously by the phase 
factors al that obey the constraints (|2.55l) and (I2.56p . 

In view of the properties (Wl) to (W5) in (|4.22[) . in particular the marginals 
property (W5), it is natural to interpret the Wigner operators as discrete phase- 
space localization operators.'22li2il Indeed, when the system is in a "position" eigen- 
state |e^), the expectation value of Wm,n equals for fc ^ m, and 1/N for k — m, 
irrespective of the "momentum label" n. Similarly, when the system is prepared in 
a "momentum" eigenstate |e°), the expectation value is for Z ^ Qn, and 1/N for 
I = Qn, whatever the value of the "position label" m. This situation is reminiscent 
of the uncertainty principle When we have a state of sharp position, here: |e^), 
then the value of the position is definite while all values of the momentum label 
are equally probable; and the analogous reverse case applies to states \e°) of sharp 
momentum. 

As appealing as this picture is, it has a flaw: The expectation value of Wm,n 



*In arbitrary odd dimensions N, one can also introduce a Wigner-type operator basis by modifying 
the parity operator of 1 14. 431 1 through a replacement of the field arithmetic by modulo- Af arithmetic 
(e -i- ejv). Consult Refs. [73l[90ll95l for details. 
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can be negative. In fact, for odd iV, we have 



w^o.o(|fc)±|efc)) = ±(|fc)±|eA;)) 



(4.43) 



for fc = 0, 1, . . . , TV — 1, so that Wo,o has the (TV + l)/2-fold eigenvalue +1 and the 
{N — 1) /2-fold eigenvalue —1. In view of the unitary equivalence property (W4), 
explicitly stated in (I4.24[) . these are also the eigenvalues of all other W,„,„s. It 
follows that the operators of the Wigner basis are not projectors, but each of them 
is rather the difference between a projector onto a [N + l)/2-diniensional subspace 
and a projector onto a {N — l)/2-dimensional subspace. 

In (|4.19|) we have one projector for each of the + 1 MUB, and it follows from 
()4.32p that the expectation value of Wm,n is maximal for these states. 



(e^^|W™,„|e^) = 1 and (e*o„en|W^m,n|e^0men> = 1 for i = 0, 1, . . . , iV - 1 . 



They are, therefore, eigenstates to eigenvalue +1, and since they are + 1 states 
in a [N + l)/2-dimensional subspace, they are clearly linearly dependent. They are 
also assuredly complete because the projector on the +1 subspace of Wm,n, 



is clearly spanned by those iV + 1 eigenstates, one from each basis. 

A direct measurement of the expectation values of all Wigner basis operators 
— or, put differently, the experimental determination of the A^^ Wigner coefficients 
'rm,n of (|4.2ip — would thus require the realization of the A^^ binary observables 
(eigenvalues ±1) that distinguish the respective subspaces. While possible in prin- 
ciple, such a procedure is not economical in practice, because two different Wm,nS 
do not commute, and each Wm,n niust be measured separately. 

Indeed, with one exception, all reports of experimentally determined Wigner 
functions — in the one-dimensional continuous case — are actually Wigner func- 
tions that are inferred from measured marginal distributions; the said exception is 
the experiment of Refs. IIOII and 11021 which implemented the scheme introduced 
in Ref. 11031 The measurements, reported in Ref. |99l of the single-q-bit Wigner 
basis (|4.37p and a particular two-q-bit Wigner basis of product form, exploited an 
optical implementation of a one-q-bit SIC POVM that is optimal for single-q-bit 
tomography.liSil 

The geometrical picture offered by the marginals and the corresponding sums 
over affine straight lines, recall (j4.25p and (j4.27p . sheds some light on the solution 
of the mean king's problem in Sec. 14.11 As noted above, the correspondence p.2p 
links (|4.27p to (|4.7p . and so we understand why the preparation of the state \e-\* ,e\) 
by the king's men is accompanied by the equiprobable firing of A'^ detectors that 
correspond to the states |(ji,i2)) with 12 = k when i = N and Qii (B i & i2 = k 
otherwise. The other detectors do not fire at all. If we re-express this property 
in terms of localization operators, in the sense of the paragraph preceding ()4.43p . 



(4.44) 




(4.45) 



66 T. Durt, B.-G. Englert, I. Bengtsson, and K. Zyczkowski 



we find that the N detectors that have a nonzero probabihty of firing correspond 
to localization operators located on a straight line for which the marginal is the 
projector \ei){el\. 



4.2.4. Covariance of the Wigner-type basis 
Upon projecting (14. 3p onto the Bell basis we get 



N- 



m,n— 

{1 for m = , 
(4-46) 
" for m > , 

where aj^ is the phase factor of (|2.54p . explicitly stated in (I2.65P for N even and in 
(|2.58l) for A'' odd, provided the symmetry property (|2.66p is imposed, as we assume 
throughout the present discussion. Then FJ^^ = ^emQn^ ^^^^ regard the 

phase factors as the appropriate square roots of -yQ™©"-. 

Making use of the transformation (|3.13l) that transforms Bell states into dis- 
placement operators we get an alternative expression for the Wigner operator Wi-^ , 

N-l 

Wna.^^ E 7®'^®"®*^®'"r™,„lC . (4.47) 

m,n— 

In view of the symmetric choice (|2.58|) . we can rewrite (|3.2ip for odd N in the form 

^7n,nV^ = C.^Tjn\n'V^,Cj with i m « = m' and TO = n' . (4.48) 

This is the transformation law of the displacement operators under a change of 
the underlying basis, the main ingredient on the right-hand side of (|4.47p . It is 
sometimes referred to as the covariance of the Heisenberg-Weyl group. 

Similarly, the permutation invariance p.23p of the Bell basis under the action 
of C* Cj is sometimes referred to as the covariance of the Bell basis. The other 
permutation invariance, noted in p.lSp . is of quite a different kind. But both reflect 
a general property: The Clifford group of unitary operators is the stabilizer of the 
Heisenberg-Weyl group. 

In addition, the affine transformation (j3.24l) that maps {m,n) onto [m' ,n') 
is a symplectic transformation in the sense that it preserves the symplectic form 
mi n2 G ni TO2. Indeed, m'^ Q n^Q n[ m'2 — toi 712 tt-i TO2 so that 

Q^»i,»2Ci = with iQiiQi2= i[ and ii=i'2, (4.49) 

which shows that the Clifford transformations C'^ correspond to affine reparam- 
eterizations of the phase-space labels of the operators in the Wigner basis, the 
phase-space localization operators. 

The transformation laws (|4.48p and (|4.49p hold for odd N with the symmetric 
choice (j2.58p . What about even prime power dimensions, N = 2^'? Here, the expres- 
sion p.65p of the phase factors a] is rather intricate and we do not know whether 
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(|4.48p and (|4.49|) are valid. It is an open question whether there is a set of field 
elements bi such that, after supplementing the a\s of (I2.65P by factors (—1)'''®', 
they conspire to produce (j4.48p and (|4.49l) . 

But one does know that other properties of Wigner operators, such as the fac- 
torization (j4.41l) into a product of M Wigner operators of dimension p, can only 
be had for odd p, not for p = 2 and M > 2.1^25111061 The two-q-bit case TV = 2^ is an 
exception; there are q-quart Wigner operators that factorize into products of two 
q-bit Wigner operators. They have been realized experimentally for the purpose of 
biphoton polarimetry.'^Sl 

We emphasize that the requirements (Wl) to (W5) in (|4.22|) are obeyed by the 
Wm,n^ for all prime power dimensions, even or odd, irrespective of the convention 
chosen for the a\s. And (W6) is of no concern for even N . 

Actually, it is easy to show that the different phase choices compatible with 
(j2.57|) preserve the MUB as a whole but shift the labels of their basis states.!^ 
The covariance of the Heisenberg-Weyl group ()4.48|) as well as the elegant trans- 
formation law (|4.49|) are guaranteed, in odd prime power dimensions, only for the 
symmetric phase-choice (|2.58|) . This also concerns the phase point operators within 
the framework laid out by Gibbons et o/.,^for which the bijection between MUB 
and Wigner operators (j4.27|) also holds by construction, independently of the choice 
of MUB and of the labeling of the MUB states. This result can be inferred in prime 
dimensions, for instance, from the study^*^^ of the properties of the Wigner oper- 
ators that correspond to different quantum nets in Wootters's terminology, or to 
different phase-choices compatible with ()2.57|) in ours. 

Another elegant feature that singles out the symmetric phase-choice (|2.58l) is 
that the corresponding Wigner function is well behaved with regard to the compo- 
sition law of Wigner operators, a property that was remarked upon by Gibbons et 
al. in Ref. IWl who noted that among all N^^^ possible choices of quantum nets, 
there exists a particular net that exhibits "more than the required symmetry." This 
singled-out net corresponds to our symmetric phase choice in (|2.58p . 

4.3. Mutually unbiased bases and finite affine planes 

The combinatorial structure that underlies the solution of the Mean King's problem 
is known as a finite afhne plane of order N. By definition an affine plane is an ordered 
pair of two sets, the first of which consists of elements Cq, called points, and the 
second of which consists of subsets L^^ of the first, called lines. Two lines whose 
intersection is empty are called parallel. The following axioms holdP^ 

Al: If and are distinct points, there is a unique line Li^ 

such that Ua G L^^ and e i^. 
A2: If Oct is a point not contained in the line L^^, there is a 

unique line L^r such that Ua G La- and La-Ci L^^ — %. 
A3: There are at least two points on each line, and there are (4.50) 

at least two lines. 



68 T. Durt, B.-G. Englert, I. Bengtsson, and K. Zyczkowski 



To see how this works, think of an ordinary afBne plane, and think of it as two sets, 
the set of points and the set of Hnes. Two points determine a unique hue, while two 
lines either intersect in a unique point, or else they are parallel and do not intersect 
at all. This is what the axioms (I4.50[) say. 

If the number of points is finite the affine plane is also said to be finite, and 
it is assigned a finite number N, called its order. A finite affine plane of order N 
has exactly points and + N lines. Each line contains N points, and N + 1 
lines intersect in each point. There are altogether A'^ + 1 pencils of parallel lines 
containing N lines each. If we label the lines of every pencil with a set of N letters, 
we can use two of the pencils to provide a "coordinate system" for the affine plane. 
Each remaining pencil then defines what is known as a Latin square — a square 
array of iV^ symbols, such that there are N different kinds of symbols, and such 
that the same symbol never occurs twice in a row or in a column of the arrayO 
Examples for such arrays are the two addition tables in Table [U but by no means 
all Latin squares arise in such an orderly manner. 

To see how this works, consider A = 3. Pick two pencils of parallel lines, and 
label their lines with 0, 1, 2 and 0', 1', 2'. The nine points of the affine plane can 
then be arranged in an array with points on the lines of the first pencil making up 
the columns, and those of the second pencil making up the rows. The lines of the 
remaining two pencils of parallel lines are labelled by A, B, C and a, /3, 7. Marking 
all points in the array that occur on line A with this letter, and so on for the other 
lines, will give rise to two Latin squares: 





1 2 




1 2 


0' 


ABC 


0' 


a 7 /3 


1' 


B C A 


1' 


/? a 7 


2' 


CAB 


2' 


7 /3 a 



(4.51) 



The squares must be Latin because the line labelled A, say, intersects each of the 
lines in the two pencils we started out with exactly once, and similarly for all other 
lettered lines. Now recall that the line labeled A intersects the line labelled a in 
a unique point. This explains why the two Latin squares we obtain must have the 
interesting property of being orthogonal Latin squares; another name for such a pair 
is a Graeco-Latin pair.ESH By definition this means that picking a pair of symbols, 
one Latin and one Greek — one from each of the two Latin squares — determines 
a unique point in the original array. To check that we did things right we simply 
superpose the two squares, and check that the pair of symbols Aa occurs once and 
once only, and similarly for all other pairs. Incidentally, we see another interesting 
thing, namely that we could just as well have used the Latin letters to label the 
columns and the Greek letters to label the rows. The symbols we used in the first 

"Sudokus are 9x9 Latin squares of a restricted kind. 
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place will then distribute themselves into another Graeco-Latin pair: 
1 2 



Aa B-f Cf3 
BP Ca A'j 
C-f A(5 Ba 





A 


B 


C 


a 


00' 


22' 


11' 


/3 


12' 


01' 


20' 


7 


21' 


10' 


02' 



(4.52) 



Given the facts about finite affine planes that were recited above, it is clear that all 
of this works for every finite affine plane, and regardless of what pencils of parallel 
lines we pick. Setting two of the pencils aside to define the array, the remaining 
N — 1 pencils always define A'^ — 1 mutually orthogonal Latin squares. This much 
is guaranteed by the intersection properties of the affine plane. Conversely, — 1 
mutually orthogonal Latin squares will define an affine plane of order N. 

But finite affine planes come with an existence problem of their own; indeed 
already Euler raised the question whether it is at all possibe to find a pair of 
orthogonal Latin squares when = 6. He phrased it as a problem concerning 36 
officers. More than a hundred years later it was proved that the answer is "no." 
This important result was reported in 1900 by the mathematician Tarry,'i2ll who 
proved by means of an exhaustive calculation that Euler's problem does not possess 
a solution, in agreement with Euler's conjecture. It follows that finite affine planes 
of order 6 do not exist. Progress since then has been slow. Finite affine planes do 
exist if = p^', where p is a prime number. They do not exist if A^ = 4fc + 1 or 
A^ = 4fc + 2 and A^ is not the sum of two squares, or if A^ = 10. All other cases 
are open. If A^ = p", a finite affine plane can be constructed using the methods 
of analytical geometry, with the finite field of order p**' as the field of scalars, but 
examples not of this form are known as well. 

A finite affine plane can be turned into a finite projective plane through the 
addition of an extra line "at infinity." It should be emphasized that finite planes, 
whether affine or projective, are much more than just interesting toys — in classical 
computer science they play prominent roles, for instance in the theory of error 
correcting codes, and we have already seen that they have quantum mechanical 
applications. 

The relation between MUB and finite affine planes can be seen already at the 
level of the MUB polytope discussed in Sec. 11.21 The idea is to represent the lines 
by the A"^ + A' vertices of the polytope, and the points by a subset of its N^'^^ 
facets. Two points are to lie on a line if the corresponding vertices are vertices of 
the same facets, and two lines intersect in a point if the corresponding facets share 
a common vertex. It turns outi^ that if an affine plane exists such a correspondence 
can always be set up, and the A^^ selected facets will then be placed in such a way 
that their centers form a regular simplex in ~^ . This construction needs neither 
finite fields nor the special feature that the vertices of the polytope correspond to 
one-dimensional projectors on Hilbert space. But when they do, it is possible to 
choose — following Wootter^^SHMI — the special set of Wigner operators that we 
have discussed in Sec. 14.2.31 a-nd to relate the construction to the partition of the 
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Heisenberg-Weyl group that is associated with the MUBp^ Then each basis is 
associated with a straight hne that passes through the origin in the plane. 

Whether there is a deeper relation between the existence problem for MUB 
and the existence problem for finite affine planes is not known today. It has been 
conjectured that such a relation exists p^^^ but a recent attempt to use a pair of 
Graeco-Latin squares that does exist when = 10 to construct a set of four MUB 
in this dimension failed.'^^ It is interesting to notice that if N mutually orthogonal 
Latin squares exist, then there always exist + 1 of them. Similarly, if N MUB 
exist, then there always exist + 1 of them.lii^l 

In the 19th century, the combinatorial structures now known as finite geometries 
were studied more concretely by geometers, who realized them as configurations of 
lines and points, or more generally as configurations of subspaces of a complex 
projective space. In 1844 Hesse, following earlier work by Pliicker, studied a 
configuration of 9 lines and 12 points in the projective plane, such that each line 
contains 4 points and each point lies on 3 lines.'- ^ - Translated into the language of 
quantum theory, where the projective plane is the set of rays in a three-dimensional 
Hilbert space {N = p = 3), Hesse's twelve points are indeed the twelve kets that 
compose the four MUB of three kets each. His construction was generalized to the 
case of arbitrary prime N by Segre,'^!! who therefore in a sense discovered the 
maximal sets of MUB in prime dimensions — although some necessary ingredi- 
ents, including the quantum mechanical significance of the construction, were very 
naturally missing. 

Segre's starting point was an elliptic curve in complex projective space, 'ii^ whose 
symmetry group consists of the Heisenberg-Weyl group together with an extra 
reflection, an element of order 2. When iV is an odd prime, there are N'^ such 
reflections, since the Heisenberg-Weyl group acts on them in accordance with (|4.24p . 
which corresponds to the condition (W4) in (I4.22p . In our terminology this means 
that he introduced a discrete parity operator with the matrix representatiorQ 

[W^0,0]a,6 = ^0,a®6- (4.53) 

This operator is both hermitian and unitary, with eigenvalues ±1, and in fact it 
splits the Hilbert space into two subspaces, of dimension n and n — 1 respectively, 
where = 2n — 1 is an odd prime. There are altogether A^^ such subspaces of 
dimension n, and Segre observed that there exists A^^ -I- A^ vectors such that each 
subspace contains A^ -I- 1 of the vectors, and each vector lies in exactly A^ of the 
subspaces. In the notation used to describe such things, we have a configuration of 
type 

{Nj,+^,N{N + l)N). (4.54) 

These incidence relations are exactly those of a finite affine plane. They are clearly 
quite remarkable: In A^ = 2n — 1 dimensions two n-dimensional subspaces intersect 



^ Since TV is an odd prime, the field addition © is modulo- TV addition. 
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in (at least) a single vector, but the remarkable thing is that only N'^ + N distinct 
vectors are needed for the entire configuration. And, of course, once we have chosen 
the standard representation of the Heisenberg-Weyl group, these N"^ + N vectors 
are precisely the kets that make up the MUB. 

To see why this is so, let us go back to the definition of the face point operators 
in ()4.30p . The first face point operator is defined by picking one projector from 
each MUB. Any choice will do. Then the combinatorics of the affine plane — or 
alternatively the action of the Heisenberg-Weyl group — will define a definite 
A^^-plet of face point operators. Now consider the kets corresponding to the + 1 
projectors we picked. Typically, A + 1 kets will span the A^-dimensional Hilbert 
space. But let us pick "the first vector in each basis" (referring to the standard set 
of MUB of [Appendix B[ ), that is: the kets represented by the columns 










(r) _ 



In 
In 



r{N^2f 
IN 

. r{N-lf 

\1n 



Kr < N . 



(4.55) 



By inspection we see that they span an n-dimensional subspace only, and indeed 
that they are all eigenvectors of Wo_q with eigenvalue +1. Since the face point oper- 
ators, and the choices of MU vectors made for them, are related by the Heisenberg- 
Weyl group, there will be altogether A^^ subspaces of this kind, and they will nec- 
essarily have the intersection properties discovered by Segre. But to him this was 
a statement about the geometry of an elliptic curve in projective space, not about 
quantum mechanics — the latter was still several decades into his future. 

Segre's observation holds true in all odd prime power dimensions. In particular, 
as observed above in the context of (|4.43p - (|4.45p . all Wigner basis operators in odd 
prime power dimensions possess a n = ^(A^-l-l)-dimensional subspace to eigenvalue 
-1-1 and a n — 1 = ^(A^ — l)-dimensional subspace to eigenvalue —1. 

In marked contrast, no similar construction is known for even A^. In this case 
there is no parity operator available, a fact that also causes well studied complica- 
tions when one tries to define analogs of the Wigner function.'^ 



5. Mutually unbiased Hadamard matrices 

5.1. Pairs of mutually unbiased bases and Hadamard matrices 

Let us look at the problem of finding MUB from a different perspective. As in 
Sec. 11.21 we represent kets as column vectors. The kets \uq), \ui), . . . , \un-i) of an 
orthonormal basis then correspond to the A^ columns of a unitary matrix U. By 
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convention, the computational basis is represented by the unit matrix 1. Then, 



U 



(0| \ 
(11 



(|uo),|Ml),---,l"Ar-l)) (5.1) 



\{N-1\J 

turns the basis kets into the unitary matrix, and 

(|uo), \u,), . . . , \u^_,)) = (|0), \l),...,\N-l))U (5.2) 

recovers the basis from U. 

If the columns of a unitary matrix are permuted, or multiplied with phase 
factors, the corresponding basis as a whole is unaffected. Therefore, we say that 
two unitary matrices are equivalent if and only if they can be related in this way, 

Uir^U2 ^ U2 = UiPE . (5.3) 

Here P is a permutation matrix and i? is a diagonal unitary matrix. 

There is a second, stronger notion of equivalence in which matrices that are 
related by permutations and rephasings of rows are also regarded as equivalent, 

Ui^U2 ^ U2 ^ E2P2U1P1E1 . (5.4) 

In particular this means that we can present every unitary matrix in dephased 
form: with all entries in the first row and the first column chosen to be real and 
nonnegative. In this respect, the second equivalence relation reminds us of how 
particle physicists treat their Kobayashi-Maskawa mixing matrix. If the matrix is 
not dephased it is said to be enphased. The core of a dephased matrix is its lower 
right square submatrix of size A'^ — 1 . 

Any basis that is unbiased with respect to the computational basis is now rep- 
resented by a complex Hadamard matrix H. This is a rescaled unitary matrix all 
of whose matrix elements have unit modulus, 

= 1, i,j ^0,...,N -I and HH'^^Nl. (5.5) 

An example which works for any N is the Fourier matrix whose matrix elements 
are 

[FN]3.k = i'n, J, fc = 0, 1, . . . , iV - 1 , (5.6) 

with — e^'^^l^ as in (|1.4p . This matrix is used to define the discrete Fourier 
transform. We recall from Sec. 11.1.21 that its existence means that pairs of MUB 
exist in all dimensions. Another example, for N = is the Galois-Fourier matrix 
[GN]j.k — 7-'®'^ with 7 = (P^'^I'P that plays a central role in the construction of the 
dual basis in Sec. 12.31 



Further examples include the Hadamard matrices Hi for the prime- 
dimensional bases associated with the unitary operators XZ"^ of (ll.27|) with 
z = 0,l,...,p— 1. In accordance with ()1.29|) . their matrix elements are 

(5.7) 
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and their unique dephased forms 

[H'fXs.^l-'' (5.8) 

are all equal to the inverse Fourier matrix. As a set, the matrices in (j5.7p are 
equivalent to the standard set of [Appendix B| in the stronger sense of (j5.4p . 

Our terminology is a bit unusual: In most of the literature a Hadamard ma- 
trix is required to have real entries only. Such real Hadamard matrices have many 
applications in computer science, and in quantum information too. SylvesteJ^^^l con- 
structed examples for all N = 2^, and HadamarcP^ proved that real Hadamard 
matrices do not exist unless N ~ 2 or N ~ Ak. It was conjectured by Palejff^that 
they do exist in all cases not excluded by Hadamard. This conjecture has been 
verified for all N < 664.^^^ By the way, the non-existence of real Hadamard matri- 
ces in dimensions not divisible by 4 means that pairs of real MUB do not exist in 
real Hilbert spaces unless their dimension equals 2 or 4A:.'i22l Another special class of 
Hadamard matrices are those of Butson typep^ which by definition have all matrix 
elements equal to rational roots of unity. The Fourier matrix, the Galois-Fourier 
matrix, and the matrices H^^'' of (15. 7p are obvious examples. For an overview of 
the theory of Hadamard matrices and their many applications, consult Horadam's 
book. 

For our purposes a pair of MUB that can be transformed into each other by an 
overall unitary matrix will be regarded as equivalent. The problem of classifying all 
such unbiased bases was first raised by Kraus.'^^lt will be convenient to distinguish 
ordered and unordered pairs. Let (Mo,Mi) denote an ordered pair of MUB, with 
each basis represented as the columns of a unitary matrix. We identify pairs that 
can be transformed into each other by means of a single unitary matrix. Therefore, 
two ordered pairs of bases will be considered equivalent, written 

(M^,M{)^(Mo,Mi), (5.9) 

if and only if there exist permutations Pq,Pi, diagonal unitary matrices i?o,£'i, 
and a unitary matrix U such that 

{UM'^PqE^, UM[PiEi) = {Mo, Ml) . (5.10) 

By using the freedom to perform overall unitary transformations, we can bring 
any pair of MUB into the standard form {1,H), where H stands for a complex 
Hadamard matrix. But this still leaves some freedom to perform permutations and 
rephasings from the left, because 

(l,i?i) - {EPlp-^E-^,EPHiPiEi) = {l,EPHiPiEi) . (5.11) 

The conclusion is that two pairs of ordered MUB, written in standard form, are 
equivalent if and only if the two Hadamard matrices are equivalent in the sense of 
(El, 



(l,iJl)^(l,iJ2) ^ H,^H2 



(5.12) 
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HaagerujP^ devised a useful way of testing for this kind of equivalence. The ma- 
trices H^^^ of jSJl) are equivalent to each other. 



Now consider unordered pairs of MUB, denoted by {Mq, AIi}. The freedom to 
perform overall unitary transformations implies that ^ {H\l). It follows 

that 

{1,H}^{1,H^. (5.13) 

Therefore unordered pairs of MUB may be equivalent even when the ordered pairs 
are not. Indeed 



f either Hi ss H; 



2 



{l,Hi}^{l,H2} ^ { . (5.14) 

[ or iJi w iJ^ . 



5.2. Triplets of mutually unbiased bases and circulant matrices 

The question when two MUB triplets, say, are equivalent is a little bit involved. In 
an ordered triplet the first two bases are kept fixed, one of them being the standard 
basis and the other some fixed Hadamard matrix Hi . Then the freedom to perform 
further permutations and rephasings from the left is severely restricted, and we can 
only say that 

{l,Hi,H2)-^{l,Hi,Hs) ^ H2-H3. (5.15) 

The converse is false. Equivalence of unordered sets of fc + 1 MUB can be discussed 
similarly, but becomes harder and harder to check in practice because there are 
fc + 1 different choices of the basis to be represented by the unit matrix. Keep- 
ing this limitation in mind, a collection of fc + 1 ordered MUB (1, iJi, . . . , Hk) is 
called homogeneous if all the Hadamard matrices Hi, i = 1, . . . , fc, are equivalent, 
and heterogeneous if there is a pair of inequivalent matrices among the Hadamard 
matrices.!^ 

Two Hadamard matrices Hi and H2 are said to be MUHM if 

-^hIH2 = i/3 , (5.16) 

V IN 

where H^ is a Hadamard matrix too. This is interesting because it implies that 
the triplet {1, Hi, H2) represents three MUB. More generally a set of N MUHM is 
equivalent to a collection of + 1 MUB. 

Triplets of MUB that include the Fourier matrix have an interesting interpre- 
tation in terms of the discrete Fourier transform. Given a sequence of complex 
numbers , < i < — 1 , its Fourier transform is 

z = Fz z = F'^z. (5.17) 

The column vector whose components are Zi/^/N is unbiased with respect to the 
Fourier basis if and only if the sequence Zi is unimodular, jz^p = 1, and it is 
unbiased with respect to the standard basis if and only if Zi is unimodular. Hence 
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vectors that are unbiased with respect to both the standard basis and the Fourier 
basis are in one-to-one correspondence to sequences obeying 

|z,|2 = |5,|2 = l (5.18) 

for all values of i. Such sequences are called biunimodular]^^^^^^ The first examples 
were in effect produced by Gauss. When N is odd they are 

zj"'™) =e¥(™i'+"i) (5.19) 

where to, n are integers modulo N and the greatest common divisor of to and N 
equals 1. To prove that these sequences are biunimodular we must perform a Gauss 
sum, as discussed in [Appendix C[ 

Biunimodular sequences have an interesting property that emerges when one 
studies the autocorrelation function 

N-l 

^-=nT. ^^^-+^ ■ (5.20) 

i=0 

An easy calculation shows that 

JV-l 

ra = J^J2\'^\'^N- (5.21) 

i=0 

Hence, if the sequence is biunimodular it obeys 

Ta = Sa,Q . (5.22) 

Therefore Zi and Za+i, with a fixed and nonzero, make up orthogonal columns. 

Any column vector can be used to define a circulant matrix^ where each column 
is obtained from the preceding one by shifting all its elements cyclically in such 
a way that all the diagonal elements are the same .1^22) For an explicit example see 
(j5.49p below. The matrix elements are 

Cij = -Si-j (mod AC) • (5.23) 

With this definition a circulant matrix is a Hadamard matrix if and only if the 
sequence Zi is biunimodular. It follows that all vectors unbiased with respect to 
both the standard basis and the Fourier basis can be collected into a set of circulant 
Hadamard matrices whose columns form bases that are unbiased with respect to the 
standard and Fourier bases. There can be no "stray" unbiased vectors not belonging 
to an unbiased basis. We observe that any circulant matrix is diagonalized by the 
Fourier matrix. More precisely, if the first column of the circulant matrix C is 
defined by the sequence Zi, then 

F^CF = diag(zo, zi,..., ZN-i) . (5.24) 

It follows that all circulant matrices commute. Moreover, via (|5.16|) this confirms 
that F and C represent a pair of unbiased bases. 
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An example of a MUB triplet of this type is the triplet consisting of the eigen- 
vectors of the three cyclic subgroups of the Heisenberg-Weyl group which exist in 
all dimensions: the three abelian subgroups composed of the powers oi X, Z, and 
XZ of Sec. I1.1.6[ for instance. When N = p is prime, one known solution for a 
complete set of MUHM consists of 1, F, and — 1 circulant matrices constructed 
from the biunimodular sequences (15.19^ given by Gauss; see [Appendix B[ 

It is natural to ask if there are other solutions. In fact this is a discrete version 
of the Pauli problemP^ Given the modulus of a function and that of its Fourier 
transform, is the function uniquely determined? Bjorck and coworkers looked into 
this question,Li2II and they found all biunimodular sequences for A^ < 8. Equiva- 
lently, they found all vectors unbiased to the Fourier matrix in these dimensions. 
For N = 5 there are 20 vectors, all of them given by Gauss's formula, for A^ = 6 
there are 48 vectors, including 12 given by Gauss, for N — 7 there are 532 vectors, 
including 42 given by Gauss, and for A^ = 8 there is an infinite number of solutions. 
This is true whenever A^ contains a square factor ,1^^ while the number of solutions 
is always finite for prime 

There are also MUHM triplets that do not include the Fourier or the Galois- 
Fourier matrix. We will see examples later. 



5.3. Classification of Hadamard matrices of size N < 5 

For N < 5 the classification of all Hadamard matrices under the equivalence relation 
(|5.4p is complete. All complex 2x2 Hadamard matrices are equivalent to the Fourier 
matrix F2, here without the 1/^2 factor of (|L22|) . 

= (;_;). (5.25) 

This is a real Hadamard matrix. When A = 3, the set of all inequivalent Hadamard 
matrices contains the only element 

/II 1\ 

= 1 7 7M , (5.26) 
7/ 

where 7 = e^'^'/"' as usuaL^i^ When A^ = 5, all complex Hadamard matrices are 
again equivalent to the Fourier matrix ^5 The known maximal sets of MUB in 
these dimensions, and indeed in all prime dimensions, consist of the standard basis 
together with equivalent Hadamard matrices of the form H EF, for p different 
choices of a diagonal unitary matrix E. 

This remark about prime dimensions is illustrated by the matrices in (|5.7|) except 
that the inverse Fourier matrix appears there, but that is only one permutation away 
from the Fourier matrix itself. Indeed, we could have the Fourier matrix just as well, 
simply by interchanging the roles of X and Z in ()1.27|) and using the eigenstates 
of X as the computational basis. Since X and Z are unitarily equivalent, the two 
sets of MUB are as well. 
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For iV = 4 the situation is different: There exists a one-parameter family of 
equivalence classes, 
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.1\ 


1 e'" 


-1 - 




1 -1 
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-1 


V 1 -ei'' 


-1 





(5.27) 



Hadamard- --'himself proved that all = 4 Hadamard matrices are equivalent to a 
member of this family, for some value < a < tt of the phase a. If a = -I, this is the 
standard Fourier matrix i^4. Choosing a = produces the Galois-Fourier matrix 
(0) F2 (8) , which is a real Hadamard matrix. 



5.4. Affine families and tensor products 

Why does the continuous family appear when TV = 4? To analyze this question we 
keep N arbitrary, multiply the matrix elements of the core of the dephased form of 
a given Hadamard matrix by arbitrary phase factors, and expand to first order in 
the angles: 

^ H,,e'^^^ ~ + i(/.,,) , 1 < z, j < iV - 1 . (5.28) 

Then we solve the unitarity equations to first order in the angles (pij. This is a 
linear system, but the number of equations exceeds the number of unknowns. 

The number of free parameters in the solution of this linearized problem is called 
the deject of the matrix H . It can be explicitly determined by computing the rank 
of a certain matrix.^i^ll The defect gives an upper bound on the dimension of any 
continuous set of inequivalent Hadamard matrices containing H . If the defect is 
nonzero it can happen that the solution to the linearized unitarity equations holds 
to all orders, in which case we speak of an affine family of Hadamard matrices .1^^ 
It can also happen that the full unitarity equations are obeyed if the angles become 
nonlinear functions of each other, and then we have a nonaffne family. If the defect 
is zero the matrix is said to be isolated. 

It is known that the defect of the Fourier matrix is zero whenever TV is a prime 
number, hence there are no continuous families containing the Fourier matrix in 
these dimensions .'^^ On the other hand, whenever N = N1N2 is a composite num- 
ber one can produce continuous affine families from any choice of Hadamard ma- 
trices in dimensions iVi and N2 liSfilESH jf both A^i and N2 are prime, N = piP2, the 
construction gives a {pi — l)(p2 — l)-dimensional orbit of inequivalent Hadamard 
matrices including the Fourier matrix, which explains what happens for iV = 4. 

A more basic, and quite important, fact about tensor product Hilbert spaces 
is the following: Let {H^,...,H^} be a set of k MUHM of size Na, while 
{Hi , . . . , H^} denotes a set of k MUHM of size Nb. Then the tensor products 
{H^ ® Hi , . . . , H^ (g) H^} form a set of k unbiased Hadamard matrices in C^^^^ . 
To prove this it is enough to check that condition ()5.16|) is obeyed. When k — 2, 
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we have 



The matrix on the right-hand side is a Hadamard matrix by assumption, and we are 
done. Note that the pair with cross terms {H^ (g) , (g) H^} is also unbiased, 
but these Hadamard matrices are not unbiased with respect to the pair used in 
(|5.29p . Hence by tensoring two sets of k MUHM of dimension Na and Nb we will 
obtain exactly k MUHM of the product structure in the extended space of size 
N = NaNb, but not more of them. This is the construction mentioned at the end 
of Sec. [mS] for Na = 2,Nb= 3, and fc = 3. 

We say that the Hadamard matrix H is separable if it is equivalent to any matrix 
of the product form 

H^Hn,<E) Hn, , (5.30) 

where H^^-^ and Hn^ are A^i x A^i and N2 x N2 Hadamard matrices, respectively. 
If this is not the case, the Hadamard matrix H of size N1N2 will be called entan- 
gled. This concept requires that a concrete tensor product decomposition is given 
beforehand. One may find a Hadamard matrix of size = 12 which is separable 
with respect to the 2x6 factorization, but entangled with respect to the 3x4 
splitting. An example is the matrix F2 <Si Sq, where 5*6 is the Tao matrix that will 
be discussed in the next section. 

5.5. Hadamard matrices of size N — 6 

= 6 is the smallest composite number for which the two factors are different, 
the smallest integer that is not a power of a prime. It is the smallest dimension for 
which the MUB existence problem is open, and it is also the smallest dimension for 
which the classification of all Hadamard matrices is an unsolved question. But the 
hunt for A'^ = 6 Hadamard matrices is ongoing, and was brought to a sunny plateau 
recently by Karlsson.'^^'i^fil 

We begin by defining an H2-reducible Hadamard matrix as a Hadamard matrix 
for which all its 2 x 2 submatrices are themselves Hadamard matrices. Karlsson 
proved the theorem that a 6 x 6 Hadamard matrix is _ff2 -reducible if and only if it 
contains a single 2x2 Hadamard submatrix. As a simple corollary, i?2-reducible 
Hadamard matrices are very easy to recognize: A 6 x 6 Hadamard matrix is H2- 
reducible if and only if its dephased form contains a matrix element equal to —1)1251 
With the sole exception of the Tao matrix, all analytically known examples take 
this form. Moreover, the set of such Hadamard matrices belong to a three-parameter 
family that was explicitly constructed by Karlsson.l^^ 
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Karlsson starts with the ansatz 

/I 1 
1 -1 



H 



1 Z3 
1-Z3 



-Zl 



1 1 \ 

Z2 -Z2 



(5.31) 



1 Z4 

\1 —Z4 • • • • j 

where the zi arc phase factors and the 2x2 blocks that have not been written out 
are guaranteed to be Hadamard matrices. We used the fact that four phase factors 
that add to zero form a rhombus in the complex plane, which is why they pair up 
in the way indicated. This ansatz is rewritten as 



/ F2 



H = 



Z3 ^Z^AZi 
Z4 ^Z^BZi 



Zi \ 
\ZiAZ2 J 



This matrix will be unitary if and only if 
A + B = F2, A-B = \/3F2iA , 



AU = 1 , At = A . 



(5.32) 



(5.33) 



The unitary 2x2 matrix A, and a fortiori the matrices A and B, will therefore 
depend on two free parameters that parameterize a sphere — which can be thought 
of as the equator of the group SU{2). We find 



^11 ^12 



^12 



^11 



with 
and 



1 .%/3, 

2 +^^'^1 + \X2+X3) , 



112 



1 .\/3, . ^ 



B{xi,X2,X3) = A{-Xi,-X2,-X3) , 

where the three real parameters {xi,X2,X3) are constrained by 

1. 



(5.34) 

(5.35) 
(5.36) 
(5.37) 



Actually, another solution is A = ±1, but in the end this gives only Hadamard 
matrices that are equivalent to one of the above. 

It remains to ensure that all matrix elements are unimodular. The conditions 
for this can be written in an elegant form using Mobius transformations that take 
the unit circle to the unit circle. Indeed 



where 



Ma{zI) = Mb{zI) , zl = Ma{zI) = MB{zi) , 

az — P 



M{z) 



P*z — a* 



(5.38) 
(5.39) 
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with the respective parameter values 



aA = , 13a = All 



OCR = ^12 I Pb = ^11 



(5.40) 



for Ma and Mb- Provided that at least one of these Mobius transformations is 
non-degenerate these equations can be solved (up to a sign) for Z2, 2^,24 in terms 
of zi , say, so together they contribute only one real parameter to the family of H2- 
reducible Hadamard matrices. There are four points where both transformations 
are degenerate, namely 



(a;i,a:2,X3) = (0,0, ±1) and (xi, 0:2, 0:3) = (±1, 0, 0) . 



(5.41) 



Hence the parameter space has three dimensions, and can be roughly described as 
a circle bundle over a two-dimensional sphere, but with four special points where 
the circle has been blown up to a torus. 

It would be desirable to work out exactly what choices of the three parameters 
lead to equivalent Hadamard matrices. This problem has been solved only partially. 
Changing the sign of any leads to equivalent Hadamard matrices. It is also known 
that the transformations 

{xi,X2,X3) {-xi,~X2,X3) (.Ti, -a;2, -X3) (-a;i, -a;2, -2:3) (5.42) 

lead to equivalent Hadamard matrices if supplemented by appropriate transforma- 
tions of the phase factors z^. Hence at most one octant of the sphere is needed in 
the parameterization. 

It remains to describe some examples of special interest. The first family to be 
discovered was the affine Fourier famil-J^^ 



F{a,b) 



1 

7Z1 



1^22 

22 
^,2 



1 



1\ 



7 7 2:1 T22 



\l 7^zi -f'^22 7 



7 



7 



21 TZ2 

1' 7' 

122 J 



(5.43) 



In the construction 



with 7 = 76 = e'^'^/^ here while 21 = e'^'^" and 22 
the two free parameters a, 6 arise because a six-dimensional space can be written 
as a tensor product. For this subfamily the equivalence problem has been fully 
understood.'^ Thus there is a discrete group acting on the square, or torus, pa- 
rameterized by a, b. It is a semi-direct group of a dihedral group with a discrete 
translation group. This dihedral group is the symmetry group of a regular hexagon. 
The result is that the original square is divided into 144 equivalent triangles of 
equal area. One of them has corners at (0,0), (g,0) and (^, ]^), and every affine 
F[a, b) is equivalent to one for which (a, b) lies within this triangle. 

The twin family of transposed matrices F'^{a,b) can be parameterized in an 
analogous way. These two families intersect at the Fourier matrix itself, 

Fe = F{0,0) = F'^{0,0) 



F2 (g) F3 W F2 



(5.44) 
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The equivalence happens because the factors of 6 = 2 • 3 are relatively prime; see 
Ref. ll38| for a general discussion of equivalences between tensor products of Fourier 
matrices. 

In the family of -ff2-reducible Hadamard matrices one finds the Fourier family 
at the special point {xi^X2,xz) = (0,0, 1), while the transposed Fourier family sits 
at [xi,X2,xz) = (1,0,0); recall that both Mobius transformations of (|5.38p - (|5.40l) 
become degenerate at these points. Curiously the one parameter family F^{Q,b) 
also sits at (0, 0, 1), and similarly F{a, 0) also sits at (1, 0, 0). 

One more affine family is known, namely the Di^a family,'^^!! which in dephased 
form is given by 

1 1\ 

— i i 
— iz — i 
i — iz* 
-1 iz* 
iz -1 / 



D{a) 



fl 
1 
1 
1 
1 



1 

-1 



1 



1 



-1 



1 

— i iz* 
— i — iz* 
i — i 



1 

— i 
iz 
-1 
i 

— iz 



with z = e'2'^'^ . 



(5.45) 



We obtain all inequivalent examples if we impose the restriction — ^ < a < ^. 



It 



includes the Butson-type matrix Dq(Q)^ known as the Di^a matrix, and composed of 
fourth roots of unity. This can be found in several different places within the three- 
parameter family, reflecting the fact that the equivalence problem for the latter is 
unsolved. One possibility is to set Xi — X2 — x-^^ in which case the Dita family is 
parameterized by the phase factor zi. 

Another Hadamard matrix of special interest is the circulant matrijP^Il 



Cb = 
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1/ 



(5.46) 



where 



d*d= 1. 



(5.47) 



The unimodular number d solves the equation d^ — (1 — \/3)d + 1 = 0. It is known 
that every circulant Hadamard matrix is equivalent to either Fq or Cg. 

Before Karlsson's work several non-linear subfamilies of Hadamard matrices 
were known. The first to be found (by Beauchamp and NicoargP^ ^g^g j^j^g Qj^g_ 
parameter family B{6) containing all Hadamard matrices equivalent to a hermitian 
matrix. It interpolates between Cg and Dq{0) in a complicated way. It is included as 
the boundary of a two-parameter family of bicirculant Hadamard matrices found 
by SzoUosi.'^^ By definition, a bicirculant matrix is divided into four blocks of 
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Ce 




B{0) 



Fig. 2. SzoUosi's two-dimensional family of A' = 6 complex Hadamard matrices interpolates 
between the generalized Fourier matrix F = _F(i, O) and the hermitian family B{9), which includes 
Ce and De- It is parametrized by the common interior of two deltoids. There are actually several 
"leaves" over the interior, and it is divided into six equivalent sectors. Dil^a's afHne family D{a), 
see 115.451 1. is represented by a circle inscribed into the figure. 

equal size, each block being a circulant matrix in itself. SzoUosi's family contains 
all bicirculant matrices with two independent blocks only, according to the pattern 



The individual entries are unimodular phase factors. Since any two circulant ma- 
trices commute the unitarity conditions are quite simple to state. Szollosi ended 
up with an appealing picture of the resulting two-parameter family. In the complex 
plane the parameter space is bounded by two deltoids related by a reflection. By 
definition a deltoid is a 3-hypocycloid, that is the curve traced out if you place the 
tip of your pen at the rim of a wheel, and then let this wheel roll inside a larger 
wheel whose inner rim has three times the radius of the rolling wheel; see Fig. [2] 
The picture is that of an umbrella, and in fact of two superposed umbrellas because 
above each point there are two inequivalent matrices that can be represented as 
the transposes of each other. Thus we have two two-parameter families Xg(a) and 
Xj (a) coming together at their common boundary. One can easily check that they 
are subfamilies of Karlsson's family. 

Another one-parameter family of symmetric Hadamard matriced^^ was ex- 
tended to a two-parameter family by Karlsson.li^ This family can be obtained 




(5.48) 



where H is bicirculant because A and B are circulant 




(5.49) 
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by setting zi = and Z3 = 2:4 in the ansatz (j5.32l) . Interestingly it is then possible 
to solve explicitly for the matrices A and B in terms of the phases z\ and Z3. 

The elegance of the available constructions is very encouraging, but they are not 
the end of the story. It has been conjecturecP^ that a four-parameter family exists. 
One reason for this is that the defect of all included matrices has been found to be 
four, whenever it has been checked,!^ and moreover there is by now strong numerical 
evidence for the conjecture.'^^'i^ Yet, the set of inequivalent iV = 6 Hadamard 
matrices is disconnected, because there is also an isolated matrix that does not 
belong to any continuous family. This is a symmetric Butson-type Hadamard matrix 
composed of third roots of unity only, known as Tao 's niatrix^^^^^^ It is isolated 
because its defect vanishes. One does not know if other isolated matrices exist. 

5.6. Hadamard matrices for N > 7 

Some general facts are known also in higher dimensions, in particular affine families 
stemming from known Hadamard matrices have been much studied. As we have 
already mentioned, the Fourier matrix is an isolated matrix if and only if is a 
prime number."^ When is a power of a prime, N = p^', all afhne orbits stemming 
from the Fourier matrix are explicitly known. The dimension of these orbits reads 
d = p"~^[{p — 1)m — p] + 1 and is equal to the defect of Fiy]^^ It is also known 
that every real Hadamard matrix admits an affine orbit if A^ > 12.'^^ In prime 
dimensions, affine orbits cannot pass through the Fourier matrix, but Petrescu 
found an example for N = 7 which contains a Butson-type matrix built from sixth 
roots of unity.'Sll 

All circulant Hadamard matrices up to A' < 9 have been found.'^^S When A' 
contains a square factor this includes a continuous familyj'i^Sl -^^iiereas the number is 
finite for all prime N\^^ Many block circulant examples are also known. ■"^"'^ Special 
methods for constructing Hadamard matrices include one based on tiling abelian 
groups ,n32i one based on A^ equiangular vectors in A^/2 dimensions ,1^^^ as well as a 
method for constructing Hadamard matrices of size A^ from matrices of size N/2. 
This gives a rich supply of examples with A^ — gUMlUMl And, of course, there are 
many ad hoc constructions. A catalog of known Hadamard matrices for A^ < 16 is 
available ,'^221 also as an updated Internet version.^i^ 

5.7. All mutually unbiased bases for N < 5 

Since we know that the Hadamard matrix in dimensions 2, 3, and 5 is unique 
up to equivalences it seems reasonable to expect that the maximal set of MUB 
is also unique up to an overall unitary transformation. When A^ = 2 a maximal 
set of MUB can be thought of — as we did in Sec. 11.21 — as a regular octahedron 
inscribed in the Bloch sphere, and the uniqueness follows from the fact that all such 
octahedra are related by a rotation, corresponding to a unitary transformation in 
the N = 2 Hilbert space. Equivalently, there is the observation of Sec. 11.1.61 that 
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q-bit operators are associated with directions in and complementary observables 
must refer to orthogonal directions. 

Uniqueness continues to hold for = 3 and = 5, although a complicated 
calculation is needed to see this The explicit form of unbiased Hadamard matrices 
forming one maximal set of MUHM for any prime N = p is provided in |Appendix B| 
Another, equivalent, maximal set is composed of the matrices H^^'^ in (|5.7p . 

The case A'^ = 4 is more interesting because of its one-parameter family of 
inequivalent Hadamard matrices. It is also simple enough that the calculations can 
be done by hand.^^ We begin by looking for ordered MUB triplets of the form 
(1, F4{a), H), where ^4(0) is written in the standard form ()5.27p and H is some 
Hadamard matrix obtained by enphasing ^4(0), possibly with its rows permuted. 
After going through all the possibilities, one finds that there are exactly three 
families of ordered triplets of MUB, with 2 or 1 + 2 free parameters each: 

;i,^^4(0),il(3)('^3;a3)). 

(5.50) 



(l,F4(a),ij(i)('^i;ai)) , (l,i^4(0),il(2)(^2;a2)) , 

The third members of these triplets are given by 
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(5.51) 



respectively. Regarded as unordered triplets, the last two are actually special cases 
of the first, so there is a single 1 + 2 parameter family of unordered triplets. 

It is straightforward to check that none of these families contains a quartet of 
MUB. The only way to obtain a quartet is to pick the third member of two different 
ordered triplets. Moreover, there is only one way in which this can be done, namely 
to set 

ai = "2 = Q!3 = - , a = = 02 = 03 = . (5.52) 

This leads to the standard solution for a maximal set of MUB, which is thereby 
shown to be unique up to an overall unitary transformation. For N — 5 there are 
two inequivalent triplets. 1^ 

Since iV = 4 gives the Hilbert space for two q-bits it is interesting to ask how 
the MUB behave with respect to entanglement. In fact three of them can be chosen 
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Table 2. One choice for the five MUB of a two-q-bit system (A'^ = 2^) can be char- 
acterized as the bases of common eigenstates to five sets of three commuting period-2 
observables each, or as the eigenstate bases of five period-4 observables. Bases 0—2 con- 
sist of product states; bases 3 and 4 consist of maximally entangled states. Together with 
the identity 1 eg) 1 and phase factors ±1, ±i, the 15 observables in the middle column 
constitute the two-q-bit Heisenberg-Weyl group; their 15 expectation values determine 
the state of the two-q-bit system uniquely. The five unitary observables in the right 
column are pairwise complementary; see Sec. 12.51 The period-5 unitary transformation 
of 115.531 1 permutes the five period-4 observables cyclically: 0— >1— >2— >3— )-4— >0. 



Set of three commuting Complementary 
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to consist of separable states only, while the remaining two are constructed out 
of maximally entangled Bell states.'^^'i^ One can understand these five MUB 
as bases composed of the common eigenstates to three two-q-bit observables with 
period 2 or, equivalently, as the eigenstate bases of pairwise complementary period-4 
operators; see Table [5p^ Alternatively we can use the magic basis for the two-q- 
bit Hilbert space, so that real vectors are maximally entangled.'i^ It is easy to 
see that there is a MUB triplet consisting of three real bases, although this is a 
triplet that cannot be extended to a maximal set. Incidentally the three real MUB 
form a maximal set for a real four-dimensional Hilbert space, and this observation is 
closely related to the existence of a platonic body in R**, called the 24-cell. The Segre 
configuration (mentioned in Sec. 14.31) has an analog known as Reye's configuration: 
If we pick a pair of vectors from two distinct bases, there is a unique vector in the 
third basis which is linearly dependent on the first two.l^^ 

We note that the unitary transformation that is defined by the mapping 

{ax (8) 1, cr^ (g) 1, 1 ® (Ta;, 1 (g) cr^) — > (ay ay,l(S a^^ay 1, a^ (g) a^) (5.53) 

is of period 5 and permutes the period-4 observables in the last column of Table [2] 
cyclically, which is why the five bases are listed in this particular order. We have here 
an illustration of the observatiortl^SHlsH that, in the case of M-q-bit systems {N = 
2"), a maximal set of A'' -I- 1 MUB can be generated from the computational basis 
by repeated application of a suitable unitary operator with period + I. When 
A^ = p^' with ]3 — 3 (mod 4) this can be done with an anti-unitary operator.1^ 



86 T. Durt, B.-G. Englert, I. Bengtsson, and K. Zyczkowski 



Table 3. Number A'^v of kets unbiased with respect to a given complex Hadamard matrix 
and the number A^t of bases (not mutually unbiased) which can be formed out of them, 
obtained for generic values of the parameters a and b as well as for |ai| < a» < \a2\ < i. 



Matrix 
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5.8. Triplets of mutually unbiased bases in dimension 6 

Since a complete list of all possible sets of five MUB in = 4 can be constructed 
by hand, one might guess that the case of = 6 could easily be settled with a com- 
puter. Numerical searches have been performed by many, but it seems that the first 
published account is the one by Zauner,'2il who was led to conjecture that at most 
three MUB can be found. By now the evidence for his conjecture is overwhelming, 
but not quite conclusive, which tells us something about how fast the complexity 
of a Hilbert space grows with dimension. 

The problem of classifying all pairs of MUB is equivalent to the problem of 
classifying Hadamard matrices. With partial results on this problem available, one 
can go on to ask what pairs can be extended to triplets of MUB, and in how 
many ways this can be done. For the Fourier family of Hadamard matrices (and 
its transpose), a clear picture has emerged IISMISS] There is very strong evidence 
that the number of kets unbiased to the bases represented by the pair (l, F{a, &)) 
equals 48, regardless of the values taken by the parameters a, b, with F{a, b) as 
introduced in (I5.43p . For generic values of the parameters these vectors can be 
collected into eight different unbiased bases which, however, are not MU. Some 
values of the parameters are special in this regard: The Fourier matrix F(0, 0) 
admits 16 unbiased basesj^ and F{^,0) admits up to 70. Note that these values of 
the parameters are special also because they correspond to singular points in the 
moduli space of all Hadamard matrices of this type, and that F{^,0) is very special 
because it is also included in the bicirculant family XQ{a). 

The evidence consists in computer calculations for a large number of members 
of the family ,1^2^ and also a proof that there exists a vicinity of (a, b) — (0, 0) where 
the number of unbiased vectors is constantP^il and equal to 48. In one version, the 
procedure begins with the observation that the condition for a ket to be unbiased 
with respect to the bases pair corresponding to (1, H), for some Hadamard matrix 
H, is a set of multivariate polynomial equations that can in principle be brought to 
"diagonal" form (in the way one would do Gauss elimination for linear equations) 
by means of Grobner bases for the polynomials. In the end polynomial equations 
in single variables are solved to high enough accuracy. The procedure works nicely 
for all of the affine families, while results for the nonaffine families are somewhat 
uncertain because of more stringent demands on computer memory. 

In Table [HI we show the number of kets unbiased to the computational basis 
and one additional listed basis, as well as the number iVt of bases (or triplets of 
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MUB) that can be formed from these vectors!^^ The results for the twin famihes 
F{a,b) and F'^{a,b) are the same, and hence results for the latter are not given 
explicitly. For the Di^a family D{a) of ()5.45|) one finds that the result depends 
on the parameter value; if \a\ < a* ~ 0.0177 there are 120 unbiased vectors, and if 
a* < |a| < I there are 48 of them. This takes care of all inequivalent values of a. 
Note that the Butson-type matrix D{Q) is quite exceptional; moreover, in this case 
the phases that define the unbiased kets are known exactly. The isolated Butson- 
type matrix 5*6 does not admit even a single triplet of MUB. 

Exactly what makes the unbiased vectors collect into bases in some, but not 
all cases, is imperfectly understood. For triplets of MUB involving F(0, 0), we have 
given the explanation in terms of the discrete Fourier transform, and for the affine 
family F[a^ b) some partial understanding exists.'^^ 

Some continuous families of triplets of MUB are known. In particular, Zauner 
showed that any bicirculant Hadamard matrix gives rise to a triplet because (j5.16l) 
can be solved for Hi and H2 if H3 is a specified bicirculant Hadamard matrix. In 
fact, the entire set of triplets in TV = 4 dimensions can be shown to arise in this way. 
For = 6, this means that SzoUosi's bicirculant family XQ{a) gives rise to a two- 
parameter set of triplets. Another continuous family of the form (l, F(0, b{t)), H{t)) 
has been constructed by Jaming et al.p^ the third member of their triplet family 
belongs to the Fourier family. 



5.9. A maximal set of mutually unbiased bases when N — 6? 

We now ask whether any of the explicitly known triplets of MUB can be extended to 
a quartet. The answer is that none of them can,'s3and the failure can be expressed 
quantitatively.!^ If a quartet involving the Fourier matrix did exist, one would be 
able to find a pair of bases among the 16 bases unbiased with respect to {1,F) such 
that the Grassmannian distance between them is equal to unity. However, the best 
one can do is = 0.93. Remembering that a random pair of bases are situated at 
a distance given by = 0.86, this is not impressive. Other pairs of MUB have not 
been treated in quite that much detail, but Jaming et al. recently proved that no 
quartets of MUB including any member of the Fourier family F{a, b) can exist .1^^ 
The proof involves approximations of the elements of the columns that represent the 
kets by rational roots of unity, exhaustive computer searches, and careful estimates 
of the errors involved. 

Direct numerical searches for maximal sets have been carried out,'2iE£ni but 
relatively few such investigations have been published. Butterley and HalP^ have 
conducted a search based on the minimization of a suitable function. The minimiza- 
tion proceeds by picking a point at random in some parameter space, and changing 
it until a minimum is reached. The problem is that this minimum may not be the 
global minimum, so the procedure could miss its target even if the target — in 
this case a quartet of MUB — is there. Indeed, the success rate was 60.4% when 
= 5, but only 0.9% when N — 7. No quartets were found for = 6. This result 
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is suggestive but not definitive. 

Brierley and WeigertfiSll concentrated on finding MU constellations, defined as 
up to + 1 sets of orthogonal kets that are MU with respect to each other. It 
is not required that the sets have N members. In fact, for iV = 6 they were able 
to find seven sets with two members each. This constellation is denoted by {2^}6, 
while a quartet of MUB is the constellation {S^jg, in a notation that should now 
be obvious (given the fact that five orthogonal vectors automatically define a sixth, 
unbiased to all vectors that are unbiased with respect to the original five). They then 
proceeded to search for constellations that necessarily exist if the quartet exists, 
such as {6, 3,3, Sje, {6,4, 3,2}6, and so on. Altogether they found 17 examples 
of such constellations for which their success rate in dimension 6 was zero. The 
advantage of the procedure is that the parameter spaces in which the search is 
conducted are comparatively small — in the two quoted examples there are 40 
parameters, as opposed to 70 parameters for a quartet of MUB. The success rates 
for similar calculations in iV = 7 were high. 

Hence we feel that the answer to the question in the title of this subsection must 
be "no." It is fair to say, however, that a structural understanding of this negative 
result is missing. A precise translation into Euler's problem of the 36 officers (see 
Sec. 14. 3|) could provide this — if there is one, and if the translation provides a 
structural understanding of the latter problem. 

5.10. Heisenberg Weyl group approach for N — 6 

We have seen how the abelian subgroups of the Heisenberg- Weyl group identify the 
maximal set of MUB if iV is a power of a prime, whereby the construction of the 
MUB relies heavily on the properties of the Galois field with N elements. As noted 
earlier, this construction is not applicable for other values of N, simply because there 
is no corresponding Galois field. The failure of this approach, therefore, says nothing 
about the existence of maximal sets of MUB in non-prime-powcr dimensions. As 
noted repeatedly, this existence problem is open, even in the most intensely studied 
case of = 5 HaiailMlElTHIini 

Since the Galois-Fourier construction of the Heisenberg-Weyl group, 
which works so well for prime power dimensions, cannot be applied for 

= 6, 10, 12, 14, . . ., one could try to repeat the procedure with operations that do 
not form a field; for instance, we could try to use distributive rings with N elements, 
possibly the modulo- ring that suffices for statements like ()1.5p F] For A^ = 6 the 
only ring is the modulo-6 ring, and we have the usual A^^ = 36 Heisenberg-Weyl 
unitary operators of Sec. 11.1.41 

Let us see. The powers of the A^ + 1 = 7 operators of (|1.27p do form seven 
abelian subgroups, but they do not exhaust all 36 products because quite 

"Recall footnote ]a]: In marked contrast to a field, a ring may have zero products of nonzero 
elements, such as 2 06 3 = 0. 
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Table 4. The twelve abelian subgroups of order six of the modulo-6 Heisenberg-Weyl 
group of unitary operators. The six elements of each subgroup are given by the powers of 
the period-6 unitary operator that generates the subgroup. These generators X'"Z" are 
listed in the second column without, however, displaying the phase factors 

ei(^/6)mn 

that are needed when the product mn is odd to compensate for the (—1)™" factor in 
l|1.20)l . The last column shows which six other generators are complementary partners. 





Period-6 


Complementary 


Subgroup 


observable 


partners 





X 


1,5,6,7,9,10 


1 


XZ 


0,2,6,7,8,11 


2 


XZ^ 


1,3,6,8,9,10 


3 


XZ^ 


2,4,6,7,9,11 


4 


XZ* 


3,5,6,7,8,10 


5 


xz^ 


0,4,6,8,9,11 


6 


z 


0, 1,2,3,4,5 


7 


x^z 


0,1,3,4, 10,11 


8 


x^z^ 


1,2,4,5, 10,11 


9 




0,2,3,5, 10,11 


10 


x^z 


0,2,4,7,8,9 


11 


x^z^ 


1,3,5,7,8,9 



a few of these products belong to more than one subgroup. For example, we have 
76X^^2 ^ {XZf = -{XZ'^Y and, therefore, the operators XZ and XZ'^ are not 
complementary. 

In total, there are twelve abelian subgroups of six elements each, the identity 
plus five more interesting ones, obtained as powers of period-6 unitary operators. 
In Table m we see that each of the these twelve "generators" has six complementary 
partners, so that the corresponding bases are MU. But there are not more than 
three bases that are pairwise MU. For instance, the bases '0' and '1' are MU and 
are both MU with bases '6' and '7', but these are not MU themselves, so that '0,1,6' 
and '0,1,7' are MUB triplets whereas '0,1,6,7' is not a MUB quartet. 

Similarly, the modulo-4 ring construction fails for N = 4.'2£l The modification 
that replaces the Galois field shifts by modulo-iV shifts simply does not work, 
except when N is prime (Sec. I1.1.6|) and the two ways of shifting coincide. 

6. Brief summary and concluding remarks 

We used the Galois-shift based Heisenberg-Weyl group to construct first maximal 
sets of MUB in prime power dimensions and then the generalized Bell states as- 
sociated with them. Several applications to quantum information processing were 
discussed, some in considerable detail: dense coding and teleportation, quantum 
cryptography and cloning machines, the Mean King's problem and state tomogra- 
phy. Owing to the somewhat unconventional parameterization in terms of numbers 
that are both field elements and ordinary integers, the approach we presented is 
relatively new, and some results are rather recent .'^'^H'phere are yet other applica- 
tions of these techniques, including the discrete phase operator^^ (that would cor- 
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respond to the dual group in our terminology), and there are interesting connections 
between MUB and SIC POYM^^^^SMSMIMM that present appealing applications 
in the framework of tomography and deserve further study. 

Some of these applications do not require the basic operations (addition and 
multiplication) of a field, a ring structure suffices, as is the case for instance for the 
SIC POVMs, teleportation, dense coding, or the discrete Weyl-type phase space 
function. All of them can be realized by use of the usual modulo- operations for 
Hilbert spaces of arbitrary dimension. For the construction of maximal sets of MUB, 
the modulo-A rings are good enough in prime dimensions only, that is: when they 
are fields. This fact enables us to design the prime-distinguishing function described 
in [Appendix C 

For what concerns the construction of MUB, the dimensionality seems to play a 
crucial role. The reasons why prime power dimensions are so special are not clearly 
understood as yet, and it is certainly worth investigating this problem in the future. 
We offer a speculation below that is suggested by the significance of the Hilbert 
space dimension in quantum physics. 

It is worth emphasizing that the search for maximal sets of inequivalent MUB 
in each dimension is related to several different mathematical problems. The liter- 
ature contains, beside the aforementioned constructions that use orthogonal uni- 
tary matrice^^^i^'^^ and discrete phase space an abundance of valu- 
able papers on the MUB problem related to group theory,'3^'2llll22Hi29| angular mo- 
mentumj^SSlElI] finite fields and affine planes and mutually orthogonal Latin 
squares ESllisij jvjgaj-iy qI\ of these constructions rely on properties of primes and 
prime powers and on an underlying finite field jllElilliMMfl After some translation 
the problem is equivalent to that of finding mutually orthogonal Cartan subalge- 
bras in the Lie algebra of SL(A^) .HSlliMI xhe problem also occurs in radar science,'^^ 
operator algehra.^^ and coding theory.l^ Geometric approaches to the problem are 
developed in Refs. [^[TMl anddH 

Let us try to collect here the information concerning the number of known 
MUB, which depends on the number-theoretic properties of the dimension N. The 
following list, which by its nature is unavoidably incomplete, contains statements 
about MUB and MUHM, which are easily translated into the respectively other 
terminology with the aid of (|5.1|) and (|5.2p . 

(a) Maximal sets of MUB exist for all prime power dimensions, N = 

(b) If the dimension is not a power of a prime, N ^ maximal sets of MUB are 
not known. It is highly unlikely that there are sets of MUB for A^ = 6 with 
more than three bases. 

(c) For any N > 2 there exists at least one triplet of MUB. This is equivalent to 
the statement that there exists at least a pair of MUHM. 

(d) For A^ = 2, 3, 4, and 5, all maximal sets of A^ -I- 1 MUB are equivalent. 

(e) For A^ > 3, there are certain sets of MUHM that cannot be extended to a 
maximal set. 
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(f) In prime dimension, N — p, all known sets of MUHM are equivalent to the 
standard set of [Appendix B[ It seems unlikely that there are other nonequiva- 
lent sets of MUHM, but we are not aware of a formal proof that they do not 
exist. 

(g) The case of a prime power dimension, N = p^', can be naturally interpreted 
as a system of M quantum degrees of freedom, each described in its own p- 
dimensional Hilbert space. In this case several sets of MUB may exist with 
different entanglement properties of the basis states. A complete set of MUB 
represented by block-circulant Hadamard matrices was constructed by Combes- 
cure.'^SSl For two, three, or four q-bits {N — 4, 8, or 16) the number of sets of 
MUB obtained from the Heisenberg-Weyl group but differing in their entan- 
glement properties is one, four, and seventeen, respectively; ^^"^ ^^ 

(h) In certain square dimensions, N = (f, the known sets of MUB are larger than 
would follow from the factorization of d. Wocjan and BetlP^ show that k 
mutually orthogonal Latin squares of order N enable one to construct k + 2 
MUB in dimension N^. For N — 26^ this yields six MUB. On the other hand, 
the product-ket construction described at the end of Sec. 11.1.51 vields at most 
p1^ + 1 MUB in dimension N = p\^ ■ ■ ■ with pi < P2 < ■ ■ ■ < Pn, whenever 
the dimension is not a prime power. It has been established^^ that one cannot 
do better by using any other group to replace the Galois-shift Heisenberg-Weyl 
group. 

Finally, a list entry about continuous degrees of freedom: 

(i) Continuous degrees of freedom have, as a rule, a continuum of MUB. An ex- 
ception is the periodic degree of freedom ("motion along a circle") for which 
only one pair of MUB is known. 

Items ((a| , (jbl , and (jgj) invite a speculation about the difference between Hilbert 
space dimensions N that are a power of a prime and those that are other composite 
numbers. In the spirit of Sec. ll.l.5| we follow Schwinger'd^HUg^jjj^g^jjpg g^jj^j associate 
one quantum degree of freedom with each prime factor oi N. If different primes 
occur, we surely have a physical system composed of different components. But if 
there is only one prime, we could have indistinguishable components, in which case 
the physical system behaves as one whole and the separation into the M subsystems 
of (jgj) is artificial because the labels m = 0,l,...,M — 1 are physically meaningless. 
From this physical point of view, then, it is quite satisfactory that prime power 
dimensions are not so different from prime dimensions (maximal sets of MUB for 
both) while other dimensions are not on the same footing (relatively few bases that 
are MU). A clear-cut demonstration that, indeed, there are no maximal sets of 
MUB for 7^ p" is surely desirable. 
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Appendix A. Generalized position and momentum operators for 
spherical coordinates 

We denote the cartesian coordinate operators by Ai, A2, and A3, and their com- 
plementary partners are the (linear) momentum operators Bi, B2, and B^. The 
Heisenberg commutation relations 



state that we have three independent copies of the A, B pair of Secs. ll.li7l and lTTl.8l 
The operators R, 9, E for the spherical coordinates, introduced in Secs. ll.l!9lll.l.ll1 

are related to the cartesian AjS in the familiar way. 



[A,,Bu] =i<5,-a 



(A.l) 



A2 



R sine 



R sine 



2 

E-E'i 



2i 



A3 



R cos e , 



(A.2) 



On mutually unbiased bases 93 



SO that the relations 



e 

tan- 

















1A2 




+ AI 



E = / (A.3) 



express the spherical coordinate operators in terms of the cartesian coordinate 
operators. 

Their complementary partners are linear functions of the cartesian momenta, 
3 1 

S = Y^-{A,B,+B,A,), 



2 



^-({A,B,^B2A2)A-i-{Al+Al)B^) , 
L = A1B2 - A2B1 . (A.4) 



" R 



Of these, the generator 5 of scaling transformations and the generator L of rotations 
around the A3 axis are familiar operators, whereas is not standard textbook fare. 

Of the fifteen commutators that involve two different ones of the operators in 
(|A.3p and (jA.4[) all vanish except for 

[i?,5]=ii?, tan®,rj =itan®, [E,L]=-E, (A.5) 

as one can verify with the aid of 

[fiA^,A2,A3),Bk] =i^/(Ai,A2,A3). (A.6) 

The numerical spherical coordinates {x,y,z) — (rsint? cos 1^9, r sin sin yj, r cos ??) 
are singular for z — ±r and, in particular, for r = and these singularities are 
inherited by the corresponding operators. The factors R in (|1.72l) and sin 8 in 
(jl.79p bear witness thereof. 



Appendix B. Standard sets of mutually unbiased Hadamard 
matrices for prime dimension 

For completeness we provide here an explicit form of a maximal set of N MUHM 
in the case of an arbitrary odd prime dimension, = p > 3. It is different from, 
and supplements, the example of (|5.7|) . 

As a first element in the set of MUHM let us choose the Fourier matrix (|5.6p . 
jjW _ Then introduce the diagonal unitary N x N matrix En with matrix 
elements 

[Swbfe = <5j,fe e'ti' where j, fc = 0, 1, 2, . . . , A^ _ 1 . (B.l) 
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It allows US to define a sequence of N matrices {H'-°\ H^^\ i/f^-i)), where 

H^"'^ = El^H^^^ for r = 0,1,2,..., A^-l. (B.2) 

By construction all these matrices are complex Hadamard matrices. Furthermore, 
the products 

are Hadamard matrices for all r 7^ s from the set {0,1,...,A^ — 1} if and only if 
the dimension A'' is an odd prime. 

Hence the set {H^°\H^^\. . . , ff(^-i)} is a set of N MUHM, referred to as the 
standard set of MUHM, which generates the standard set of N +1 MUB, according 
to (|5.16|) . We observe that, just like the set (j5.7p . this set of Hadamard matrices is 
homogeneous, since all its members arise by enphasing the same Fourier matrix i^jv, 
hence they are equivalent and share the same core. The equivalence of the standard 
set of MUHM and the set of (|5.7p is shown with the aid of the identity 

^j{j-l) = ^q{q-l) + q(j-qf (mod TV) with g = i(7V + 1) , (B.4) 

which is valid for all odd N values. 



Appendix C. A prime-distinguishing function 

We return to Sec. 11.1.61 but now consider the + 1 operators of p.27p for arbitrary 
values of A?^ > 2. In accordance with 

X w f 1 if TV is odd 1 , . , , , 

^ ^ [ (-1)"1 if is even] 

for n = 0, 1, 2, . . . , — 1, the eigenkets \n, k) of A"Z" obey the eigenvalue equation 

XZ"|n,fc) = |n,fc)/3^(n)7^ with /3jv(n)^ = (-l)(^-i)" . (C.2) 

For n = 0, we have the eigenkets of X and choose (3^(0) = 1 to enforce consistency 
with (|1.6p - (jl.8p . that is: |0, j) = for n = 1,2, . . . , N — 1 we choose a convenient 
convention for Pj^iji) in (|C.11|) below. As always, we have 7^ = gi27i"/-'V ]-^gj.g^ g^j-^^j 
we recall the Weyl commutation rule -fj^XZ — ZX, the central algebraic property 
of the period- A^ unitary operators X and Z introduced in Sec. 11.1.21 

The projector on the A:th eigenstate of XZ" is given by the appropriate analog 
of (fTTl) . 

1 / X 7'" \ ' 
Kfc)(n,fc| = -^ . (C.3) 
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We use this to evaluate the transition probability between |n, k) and |0, j) in terms 
of a trace, 

\{0,j\n,k)\ =tr< V ^ . ^ fc -r 

N-l 

= ]^ E /3^(n)-Sr'^'tr{(XZ")'x-'} , (C.4) 
/=o 

where we have recognized that only terms with I + 1' = (mod N) contribute to 
the double sum. ^ 

As an immediate consequence of(XZ") =7|r ^ ^X'Z"',weget 

tr{(XZ")'x-'}=7V7i"'^'"'^C, (C.5) 
where we meet the modulo- Kronecker symbol that is defined by 

f 1 if i = (mod N) , 
^' [ if i 7^ fc (mod N). 
To proceed further, we write 

N = N1N2 > 2, 

n = mNi > 1 , (C.7) 

where iVi is the greatest common divisor of n and N, Ni — gcd(n, N) > 1, which 
implies that m and N2 are co-prime, gcd(m, A^2) = 1- For I — I1N2 + I2 with 
li = 0, 1, . . . , A'^i — 1 and ^2 = 0, 1, . . . , iV2 — 1, we then have 

"nl,0 — "mhNuO — "mh-.O - "h.O ' \^-°) 

so that 

tr{(XZ")'x-'} = Af7j™'^'^^'^'^^~'^<5S^ 
^ 7V(_l)™'i('iA^2-i)j(iV2) 

= Ar(_l)(^2-i)hj(A'.) ^ (c_g) 

where we encounter a distinction between even and odd N2 values that is quite 
similar to the even-odd distinction in (jC.l|) . The last equality in (jC.9P recognizes 
that li{liN2 — 1) is even when 7V2 is odd and that m is odd when N2 is even. 
After combining the various ingredients, (IC.4I) turns into 



|(0,j|n,fc)|^ = ^ E i-ir^''^''Mnr^''^j^^;'^'' , (C.IO) 

ii=0 

and upon imposing 

PN{nf^ = i-lf^--' (C.ll) 
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we arrive at 

\{0,j\n,k)\' = ^j\f\ 
with the shghtly frivolous convention of S^^^ = 1 for all j,k. Inasmuch as 



(C.12) 



72Ar, = I2A = e^"/^' if ^2 is even ' 



for n = 1,2,...,A^- 1 



1 if N2 is odd J 

(C.13) 

obeys the requirement in (IC.2P and also meets the constraint (jC.llI) . it is indeed 
permissible to impose the latter. Other choices for /3^(ri), as permitted by (jC.2p . 
differ from this l3j^{n) by a power of 7jy, equivalent to a cyclic relabeling of the 
states in the nth basis. 
In summary, we have 

\/]V |(0, j|n, k) I = ^iVT^S'^ with Ni = gcd(n, N) (C.14) 

for n = 1, 2, . . . , — 1. It follows that the 0th basis and the nth basis are MU only 
if gcd(n, N) — 1, which can be true for all n only if TV is prime: The N + 1 bases of 
eigenstates of the operators in (|1.27p do not constitute a maximal set of MUB if N 
is composite. 

The general- iV version of (|1.29p is 



(C.15) 



which follows from (jC.2[) upon recalling that {l\Z ^ j'-j^m and {I + 1\X = This 
agrees with (|1.29p for odd N values, for which f3j^{n) — 1. For k ^ j + a in (|C.14p 
we then have 



'N\{0,j\n,j + a) 
where we choose 



1 



N-1 



1=0 



-I 1 
n] In 



nl{l-l) 



= VNiS, 



a,0 I 



(C.16) 



-{N-l)n 



if N2 is odd. 



1 . ^ 1 

-{N - l)n - -Ni if A^2 is even. 



(C.17) 



so that 



a _ (N-l)n 



PN{-n)lN = iIn 



(C.18) 



and, therefore, 

N-1 

l2N 



1 



-(N-l)nl ^nl{l-l) 

In 



N-1 



(l-N)ln 



1=0 



'Nisi:- 



(C.19) 
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for all = 2, 3, 4, . . . and n = 1, 2, . . . , — 1. After taking into account that 

a ^ (mod A^i) if A^ is even and N2 is odd and m is odd 
whereas a = (mod A^i) otherwise, (C.20) 

this states that 

N 



1 



/ . ^2N 



1=0 



if A' even with both 



gcd(n, A^) 



and 



;cd(n, N) 



A/gcd(n, N) else, 



odd, 



(C.21) 



which can also be verified by expressing the sum over / in terms of standard Gauss 
sumsfi^ see, for example, pages 85-90 in Ref. 11961 

It follows from (jC.21[) that the function A^ 1— g{N) that is defined by 



N-l 



9{N) 




N-l 



- 1 



for A^ > 1 can be evaluated as 



9{N) = Y,' .JgcA{n,N)-{N ^1), 



(C.22) 



(C.23) 



n=l 



where the primed summation omits all even-A'^ terms for which both N / gcd(r7,, A^) 
and n/ gcd(n, A^) are odd. There are no omissions if A^ is odd or a power of 2. 
The g{) oi (|C.22I) is a prime- distinguishing function in the sense of 



g{N) = if A^ is prime, 
g{N) 7^ if A^ is composite. 



(C.24) 



because gcd(n, A^) — 1 for all n when A^ is prime, whereas gcd(n, A^) > 1 for some n 
when A^ is composite. In the latter situation, the right-hand side of (|C.23|) contains 
a sum of the irrational square roots of the prime factors of A^, and possibly products 
of these square roots, with positive integer weights, and no such sum can be rational, 
so that g{N) is irrational and g{N) = is impossibleEl 
For odd A^, equivalent forms of g{N) are 



N-l/ 
n=l 



N-l 



1 



1=0 
N-l 

1=0 

of which the first is obtained from (jC.22p by the shift I 
over I, and the second identity follows from (|B.4|) with r 



(C.25) 

I + i(7V - 1) in the sum 
= nq. Here we make contact 



''We owe this argument to M. Grassl. 
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with [Appendix B| inasmuch as 

N-l , N- 

g{N)=Y,(\[XrU\-l) = J2 




- 1 , (C.26) 

r=l 

in accordance with (|B.3P : the index i is arbitrary here because the XrS are circulant 
matrices. For N = p, an odd prime, we encounter in (|C.25P the well known Gauss 
sunPfil 



p-i 

3=0 



Vp- (C.27) 



As just demonstrated, it is needed to check explicitly that the Hadamard matrices 
given in [Appendix B| really are MU when the dimension is prime (see, for instance, 
Refs. [22 1 and .34.) . and ([C.27| is also a key ingredient for conceiving a maximally 
entangling quantum gate that generalizes the two-q-bit CNOT gate in arbitrary 
dimensionP^ 

Concerning the composite- case of ([C.24I) . we can be more specific about 
g{N) ^ 0. In fact, 

g{N) > if A^ is odd and composite 

or Af is a muhiple of 4, (C.28) 

and g{N) < can only occur when A^ is an odd multiple of 2. The case of composite 
odd A^ is immediate because there are no terms omitted in (IC.23p . For even N, we 
exploit the identity 

OM _ o(m — l)/2 OM _ om/2 

5(2-.) = 3(2") + g{.) + -JZ^i^-^) 

^2(M-i)/2(2M/2 _ 1 _ 2-1/2) (i. _ ^) ^ 29) 

which is valid for M = 1, 2, . . . and odd v > 3; it holds also for = 1 if we adopt 
the convention that g{l) = 0. The first three summands on the right-hand side of 
(|C.29p cannot be negative, whereas the fourth is positive for M > 1 and negative 
for M = 1. Indeed, we have 

gi2p) = ^t_l{V2 + l-^) (C.30) 

when p is an odd prime. 

The value of g (2^') , needed in (|C.29p , is available as the p = 2 version of the 
general prime-power value of g{N) that is given by 

c,(p^') = (/•/2 _ 1) (p(^i-i)/2 _ 1) foj. p prime. (C.31) 

We have, in particular, g{2p) < for p > 7, g{2p'^) < for p > 29, and g{2p'"^) < 
for p > 37 when M > 2. A survey for A^ up to 2 x 10^ established that there are 
92, 676, 6949, 77310, and 155150 A^ values not exceeding lO^, 10^, 10^ 10^ and 
2 X 10^, respectively, for which g{N) < 0. These matters are illustrated in Fig. [3l 
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Fig. 3. The prime-distinguishing function g{N) of | |C.21| | for 2 < N < 50; for normahzation, the 
function values are divided by A'^ — 1. Straight hncs connect successive values of g{N)/{N — 1) 
to guide the eye. Filled squares show where g{N) = 0, which happens when N is prime. Empty 
squares indicate g{N) ^ and so identify composite A'^ values. Consistent with l lC.2811 . we have 
g{N) < for Af = 14, 22, 26, 34, 38, and 46, with the respective g(N) values given by HO. 3011 . 



Equations (jC.29p and (jC.30P are particular cases of the general factorization 
formula 



h{NiN2) = h{Ni)h{N2) if gcd(7Vi,iV2) = 1 , 
where the auxiliary function N i— > h{N) is defined by 

N + Vn -1 if iV is odd 



(C.32) 



hiN) = giN) 



N - 



N- 1 

Af-l 



Tl=l 



if N is even 



JV-l 
1=0 



)ln 



(C.33) 



for N = 1,2,3,...; consistent with the convention g{l) = 0, we have h{l) = 1. One 
establishes (IC.32[) by an exercise in counting that exploits the explicit form of g{N) 
in lfC:23l) . 

We observe, as an immediate consequence of (|C.32I) . that 



h{N)^h{p'l^)h{p^-)h{pt^) 



{CM) 



if TV = • • • is the prime-factor decomposition of N . In conjunction with 

(|C.31[) this facilitates the computation of g{N) without an actual evaluation of the 
summations in (|C.22p or (|C.23p . 

As a final remark we note that the derivation of (|C.2ip with quantum-mechanical 
reasoning in the context of searching for MUB in dimension N seems to indicate 
that the existence problem of maximal sets of MUB and MUHM is related to 
number-theoretical properties of the dimension. We leave the matter at that. 
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Appendix D. Mutually unbiased bases for N — 4 

In accordance with (|2.70p , the set of MUHM for the maximal set of MUB for N = p 
of Sec. [2] is given by 



(D.l) 



for j,k,l — 0,1, . . . , N — I, so that ijj — Aj Gj^^ is the product of the inverse 
Galois-Fourier matrix with matrix elements 



and the diagonal matrix of phase factors 



(D.2) 



(D.3) 



with Aq — and Hq = in particular for the 0th basis, the dual basis. 
The conventional choices for aj are found in ()2.58p for odd N and in (j2.65p for even 
tV. For even N = 2", we note that Ql = I for all field elements and = 
since 7 = — 1 . 

As an example, we consider N ~ A with the field addition and multiplication 
tables of TablcfTfa). The Fourier-Galois matrix G4 is the tensor product of G2 with 
itself 



H, 



(4) 



G: 



G4 



^1111^ 

1-1 1-1 



G2 G2 
G2 — G2 



G2 «) G2 , 



(D.4) 



1 1-1-1 

Vi-1-1 1/ 

where G2 is the 2x2 Hadamard matrix of (|1.22p . We are reminded here of the sign 
sequences in (|4.37p . The binary components I — {Iq,Ii) of the four field elements 
— (0, 0), 1 = (1, 0), 2 = (0, 1), and 3 — (1, 1) are needed for the calculation of the 
phase factors 

1 



A = 4 : a^g/ = af - [] („i)J-0(U2")0(i„2") 

m,n— 

along with 2° 2° = 1, 2° 2^ = 2^ 2^ = 2, 2^ 2^ = 3. This gives 



and 



(_i)J-01[(_i)J02]2^_.p3 ^ (_iy+J-03(_i),02 



The resulting phase matrices are A^^^ — I4 and 



A 



(4) 



/I 

-i 

i 

Vo 1/ 



/I 0\ 

0-100 
-i 
Vo -i/ 



.(4) _ 
/I3 - 



(D.5) 

(D.6) 
(D.7) 

\ 



/I 
i 
0-10 
Vo ij 
(D. 
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and the Hadamard matrices are H, 



(4) 



Ga as well as 



' 1 
— i 
i 



i — i i 
i — i — i 



V 1-1-1 1/ 



^2 — 



^111 

-1 1 -1 

— i — i 

V-i i 



1\ 

1 

i i 
i -i/ 



^(4) _ 
-"3 — 



^, the columns of 



(4) 



1 1 1 1\ 

i — i i — i 
-1-1 1 1 

V 1 -i -i i/ 
(D.9) 

represent the kets of the jth 



When multiplied by ^, ^ ^ 

bases with reference to the computational basis, the 4th basis0 Up to relabeling 
they coincide with those derived by Bandyopadhyay et al. in a similar fashionP^ 
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